Input:
int main() {
  int x = 0;
  while (x < 100) {
    x = x + 1;
  }
  //@ assert x == 100;
}

Output:
int main() {
  int x = 0;
  /*@
  loop invariant x <= 100;
  loop invariant 0 <= x;
  loop assigns x;
  */
  while (x < 100) {
    x = x + 1;
  }
  //@ assert x == 100;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 2;
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (y == 1) {
    //@ assert i == j;
  }
}

Output:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 2;
  /*@
  loop invariant y == 2;
  loop invariant j == i*2;
  loop invariant j == i * 2;
  loop invariant j == 2*i;
  loop invariant 0 <= j;
  loop invariant 0 <= i;
  loop assigns y,i,j;
  */
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (y == 1) {
    //@ assert i == j;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires a <= m;
*/
void foo(int a, int m, int c) {
    int j = 0;
    int k = 0;
    while (k < c) {
        if(m < a) {
            m = a;
        }
        k = k + 1;
    }
    //@ assert a <= m;
}

Output:
/*@
requires a <= m;
*/
void foo(int a, int m, int c) {
    int j = 0;
    int k = 0;
    /*@
    loop invariant a <= m;
    loop invariant 0 <= k;
    loop invariant (m < a ==> m == a);
    loop assigns m,k,a;
    */
    while (k < c) {
        if(m < a) {
            m = a;
        }
        k = k + 1;
    }
    //@ assert a <= m;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires 0 <= x <= 10;
  requires 0 <= y <= 10;
*/
void foo(int x, int y) {
  while (unknown()) {
    x  = x + 10;
    y  = y + 10;
  }
  if (x == 20) {
    //@ assert y != 0;
  }
}

Output:
/*@
  requires 0 <= x <= 10;
  requires 0 <= y <= 10;
*/
void foo(int x, int y) {
  /*@
  loop invariant x != 20 || y != 0;
  loop invariant 0 <= y + 10;
  loop invariant 0 <= x + 10;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns y,x;
  */
  while (unknown()) {
    x  = x + 10;
    y  = y + 10;
  }
  if (x == 20) {
    //@ assert y != 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stddef.h>
#include <limits.h>
void max_ptr(int* a, int* b) {
    if(*a < *b) {
      int tmp = *b ;
      *b = *a ;
      *a = tmp;
    }
}
extern int h ;
int main() {
  h = 42 ;
  int a = 24 ;
  int b = 42 ;
  max_ptr(&a, &b) ;
  //@ assert a == 42 ;
  //@ assert b == 24 ;
}

Output:
#include <stddef.h>
#include <limits.h>
/*@ requires \valid(a) && \valid(b);
    assigns *a, *b;
    ensures a_in_nums: *a \in { \old(*a), \old(*b) } ;
    ensures b_in_nums: *b \in { \old(*a), \old(*b) } ;
    ensures a_is_max: *a >= \old(*a) && *a >= \old(*b);
    ensures b_is_min: *b <= \old(*a) && *b <= \old(*b);
    behavior a_max:
      assumes *a > *b;
      ensures *a == \old(*a) && *b == \old(*b);
    behavior b_max:
      assumes *b > *a;
      ensures *a == \old(*b) && *b == \old(*a);
    behavior equals:
      assumes *a == *b;
      ensures *a == \old(*a) && *b == \old(*b);
    complete behaviors;
    disjoint behaviors;
*/
void max_ptr(int* a, int* b) {
    if(*a < *b) {
      int tmp = *b ;
      *b = *a ;
      *a = tmp;
    }
}
extern int h ;
int main() {
  h = 42 ;
  int a = 24 ;
  int b = 42 ;
  max_ptr(&a, &b) ;
  //@ assert a == 42 ;
  //@ assert b == 24 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Compute the factorial of a given no. with precondition and postcondition

Input:
#include<stdio.h>
/*@
logic integer fact(integer n)=(n<1)? 1:n*fact(n-1);
*/
int fact(int n)
{
if(n<2)
return 1;
int f=1;
int i;
for(i=1;i<=n;i++)
{
f=f*i;
}
return f;
}
int main()
{
int k=fact(5);
//@ assert k==120;
}

Output:
#include<stdio.h>
/*@
logic integer fact(integer n)=(n<1)? 1:n*fact(n-1);
*/
/*@
assigns \nothing;
ensures \result==fact(n);
*/
int fact(int n)
{
if(n<2)
return 1;
int f=1;
int i;
/*@
loop invariant 1<=i<=n+1;
loop invariant f==fact(i-1);
loop assigns i,f;
loop variant n-i;
*/
for(i=1;i<=n;i++)
{
f=f*i;
}
return f;
}
int main()
{
int k=fact(5);
//@ assert k==120;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int last_angle(int first,int second){
    if(first < 0 || first > 180 || second < 0 || second > 180 || first + second > 180){
        return -1;
    }
    return 180 - first - second;
}
int main(){
    int first = 60;
    int second = 90;
    int result = last_angle(first,second);
    //@ assert result == 30;

    first = 100;
    second = 100;
    result = last_angle(first,second);
    //@ assert result == -1;
    return 0;
}

Output:
/*@
    behavior error:
        assumes first < 0 || first > 180 || second < 0 || second > 180 || first + second > 180;
        ensures \result == -1;
    behavior valid:
        assumes first >= 0 && first <= 180 && second >= 0 && second <= 180 && first + second <= 180;
        ensures \result == 180 - first - second;
    complete behaviors;
    disjoint behaviors;
*/
int last_angle(int first,int second){
    if(first < 0 || first > 180 || second < 0 || second > 180 || first + second > 180){
        return -1;
    }
    return 180 - first - second;
}
int main(){
    int first = 60;
    int second = 90;
    int result = last_angle(first,second);
    //@ assert result == 30;

    first = 100;
    second = 100;
    result = last_angle(first,second);
    //@ assert result == -1;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i >= x) {
    if (0 > i) {
      //@ assert i >= y;
    }
  }
}

Output:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  /*@
  loop invariant i <= y;
  loop invariant 0 <= i;
  loop assigns x,y,i;
  */
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i >= x) {
    if (0 > i) {
      //@ assert i >= y;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Sum of first n numbers using ‘while’ loop with precondition and postcondition

Input:
#include<stdio.h>
#include<limits.h>
int add(int n)
{
int i=1;
int s=0;
while(i<=n)
{
s=s+i;
i++;
}
return s;
}
int main()
{
int k;
k=add(5);
//@ assert k==15;
}

Output:
#include<stdio.h>
#include<limits.h>
/*@
requires n>0;
ensures \result==n*(n+1)/2;
*/
int add(int n)
{
int i=1;
int s=0;
/*@
loop invariant s==(i-1)*i/2;
loop invariant 1<=i<=n+1;
loop assigns i,s;
loop variant n-i;
*/
while(i<=n)
{
s=s+i;
i++;
}
return s;
}
int main()
{
int k;
k=add(5);
//@ assert k==15;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int foo(int a,int b){
if(a>=0){
a++;
}
else{
a+=b;
}
return a;
}
int main(){
int x=-99;
int y=100;
int r=foo(x,y);
//@assert x==-99 && y==100 && r==1;
}

Output:
#include<limits.h>
/*@
requires INT_MIN<=a<INT_MAX;
requires INT_MIN<=b<INT_MAX;
assigns \nothing;
behavior a_pos:
    assumes a>=0;
    ensures \result == a + 1;
behavior a_neg:
    assumes a < 0;
    ensures \result == a + b;
disjoint behaviors;
complete behaviors;
*/
int foo(int a,int b){
if(a>=0){
a++;
}
else{
a+=b;
}
return a;
}
int main(){
int x=-99;
int y=100;
int r=foo(x,y);
//@assert x==-99 && y==100 && r==1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stdio.h>
int dsum(int n)
{
int i=1;
int sum=0;
for(i=1;i<=n;i++)
{
sum=sum+3*i;
}
return sum;
}
int main()
{
int k=dsum(3);
//@ assert k==18;
}

Output:
#include<stdio.h>
/*@
requires n>0;
ensures \result==(3*(n*(n+1)/2));
*/
int dsum(int n)
{
int i=1;
int sum=0;
/*@
loop invariant 1<=i<=n+1;
loop invariant sum==(3*((i-1)*i/2));
loop assigns sum,i;
loop variant n-i;
*/
for(i=1;i<=n;i++)
{
sum=sum+3*i;
}
return sum;
}
int main()
{
int k=dsum(3);
//@ assert k==18;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdio.h>
int func(int c) {
    int x = c;
    int y = 0;
    while(x > 0) {
        x = x - 1;
        y = y + 1;
    }
    return y;
}
void main() {
    int t = func(5);
    //@ assert t == 5;
}

Output:
#include <stdio.h>
/*@
    requires c > 0;
    ensures \result == c;
    assigns \nothing;
*/
int func(int c) {
    int x = c;
    int y = 0;
    /*@
        loop invariant c == x + y && x >= 0;
        loop assigns x, y;
    */
    while(x > 0) {
        x = x - 1;
        y = y + 1;
    }
    return y;
}
void main() {
    int t = func(5);
    //@ assert t == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@ requires n >= 0;
    requires \valid(a + (0..n-1));
    assigns \nothing;
    behavior empty:
      assumes n == 0;
      ensures \result == 0;
    behavior not_empty:
      assumes 0 < n;
      ensures 0 <= \result < n;
      ensures \forall integer i; 0 <= i < n ==> a[i] <= a[\result];
      ensures \forall integer i; 0 <= i < \result ==> a[i] < a[\result];
    complete behaviors;
    disjoint behaviors;
*/
int max_element(int* a, int n)
{
   if (n == 0) {
      return 0;
   }
   int max = 0;
   /*@
       loop invariant 0 <= i <= n;
       loop invariant 0 <= max < n;
       loop invariant \forall integer k; 0 <= k < i ==> a[k] <= a[max];
       loop invariant \forall integer k; 0 <= k < max ==> a[k] < a[max];
       loop assigns max, i;
       loop variant n-i;
   */
   for (int i = 1; i < n; i++) {
      if (a[max] < a[i]) {
         max = i;
      }
   }
   return max;
}
int max_seq(int* p, int n)
{
   return p[max_element(p, n)];
}
int main()
{
   int a[] = {1, 2, 3, 4, 5};
   int n = 5;
   int max_value = max_seq(a, n);
   //@ assert max_value == 5;
}

Output:
/*@ requires n >= 0;
    requires \valid(a + (0..n-1));
    assigns \nothing;
    behavior empty:
      assumes n == 0;
      ensures \result == 0;
    behavior not_empty:
      assumes 0 < n;
      ensures 0 <= \result < n;
      ensures \forall integer i; 0 <= i < n ==> a[i] <= a[\result];
      ensures \forall integer i; 0 <= i < \result ==> a[i] < a[\result];
    complete behaviors;
    disjoint behaviors;
*/
int max_element(int* a, int n)
{
   if (n == 0) {
      return 0;
   }
   int max = 0;
   /*@
       loop invariant 0 <= i <= n;
       loop invariant 0 <= max < n;
       loop invariant \forall integer k; 0 <= k < i ==> a[k] <= a[max];
       loop invariant \forall integer k; 0 <= k < max ==> a[k] < a[max];
       loop assigns max, i;
       loop variant n-i;
   */
   for (int i = 1; i < n; i++) {
      if (a[max] < a[i]) {
         max = i;
      }
   }
   return max;
}
/*@ requires n > 0;
    requires \valid(p + (0..n-1));
    assigns \nothing;
    ensures \forall integer i; 0 <= i <= n-1 ==> \result >= p[i];
    ensures \exists integer e; 0 <= e <= n-1 && \result == p[e];
*/
int max_seq(int* p, int n)
{
   return p[max_element(p, n)];
}
int main()
{
   int a[] = {1, 2, 3, 4, 5};
   int n = 5;
   int max_value = max_seq(a, n);
   //@ assert max_value == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
    int x = 1;
    int y = 0;
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
      //@ assert y >= 0;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
    int x = 1;
    int y = 0;
    /*@
    loop invariant y <= n - 1;
    loop invariant 0 <= y;
    loop assigns n;
    loop invariant x <= n+1;
    loop invariant x <= n + 1;
    loop invariant 1 <= x;
    loop invariant 0 <= x;
    loop assigns y;
    loop assigns x;
    */
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
      //@ assert y >= 0;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
size_type
max_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type max = 0u;
    for (size_type i = 1u; i < n; i++) {
      if (a[max] < a[i]) {
        max = i;
      }
    }
    //@ assert \forall integer i; 0 <= i < n ==> a[i] <= a[max];
    return max;
  }
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  requires valid:   \valid_read(a + (0..n-1));
  assigns           \nothing;
  ensures  result:  0 <= \result <= n;
  behavior empty:
    assumes          n == 0;
    assigns          \nothing;
    ensures result:  \result == 0;
  behavior not_empty:
    assumes          0 < n;
    assigns          \nothing;
    ensures result:  0 <= \result < n;
    ensures upper:   \forall integer i; 0 <= i < n       ==> a[i] <= a[\result];
    ensures first:   \forall integer i; 0 <= i < \result ==> a[i] <  a[\result];
  complete behaviors;
  disjoint behaviors;
*/
size_type
max_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type max = 0u;
    /*@
      loop invariant bound:  0 <= i <= n;
      loop invariant max:    0 <= max <  n;
      loop invariant upper:  \forall integer k; 0 <= k < i   ==> a[k] <= a[max];
      loop invariant first:  \forall integer k; 0 <= k < max ==> a[k] <  a[max];
      loop assigns max, i;
      loop variant n-i;
    */
    for (size_type i = 1u; i < n; i++) {
      if (a[max] < a[i]) {
        max = i;
      }
    }
    //@ assert \forall integer i; 0 <= i < n ==> a[i] <= a[max];
    return max;
  }
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main(){
    int x = 0;
    int y = 0;
    while(y >= 0){
        y = y + x;
    }
    //@ assert  y >= 0;
}

Output:
int main(){
    int x = 0;
    int y = 0;
    /*@
    loop invariant x == 0;
    loop invariant \forall integer k; 0<= k < x ==> y >= 0;
    loop invariant 0 <= y;
    loop invariant 0 <= x;
    loop assigns y;
    loop assigns x;
    */
    while(y >= 0){
        y = y + x;
    }
    //@ assert  y >= 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int y) {
  int x = 1;
  while (x < y) {
    x = x + x;
  }
  //@ assert x >= 1;
}

Output:
void foo(int y) {
  int x = 1;
  /*@
  loop invariant 1 <= x;
  loop assigns y;
  loop assigns x;
  */
  while (x < y) {
    x = x + x;
  }
  //@ assert x >= 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int fun(int x, int y) {
    int r = x;
    int d = 0;
    while (r >= y) {
        printf("r = %d   d = %d   y = %d   x = %d\n", r, d, y, x);
        r = r - y;
        d = d + 1;
    }
    //@ assert r + d*y == x;
    return d;
}

Output:
int fun(int x, int y) {
    int r = x;
    int d = 0;
    /*@
        loop invariant r + d*y == x;
    */
    while (r >= y) {
        printf("r = %d   d = %d   y = %d   x = %d\n", r, d, y, x);
        r = r - y;
        d = d + 1;
    }
    //@ assert r + d*y == x;
    return d;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int arraysearch(int* a, int x, int n) {
  for (int p = 0; p < n; p++) {
    if (x == a[p])
    //@ assert \exists integer k;  0 <= k <= p && x == a[k];
       return 1;
  }
  return 0;
}

Output:
/*@
requires n > 0;
requires \valid_read(a + (0..n-1));
assigns \nothing;
behavior present:
    assumes \exists integer k;  0 <= k < n && x == a[k];
    ensures \result == 1;
behavior not_present:
    assumes \forall integer k;  0 <= k < n ==> x != a[k];
    ensures \result == 0;
disjoint behaviors;
complete behaviors;
*/
int arraysearch(int* a, int x, int n) {
  /*@
     loop invariant 0 <= p <= n;
     loop invariant \forall integer k;  0 <= k < p ==> x != a[k];
     loop assigns p;
 */
  for (int p = 0; p < n; p++) {
    if (x == a[p])
      //@ assert \exists integer k;  0 <= k <= p && x == a[k];
       return 1;
  }
  return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int sn = 0;
  int x = 0;
  while (unknown()) {
    x = x + 1;
    sn = sn + 1;
  }
  if(sn != x) {
    //@ assert sn == -1;
  }
}

Output:
int main() {
  int sn = 0;
  int x = 0;
  /*@
  loop invariant x == sn;
  loop invariant x <= sn;
  loop invariant sn == x;
  loop invariant sn <= x;
  loop invariant 0 <= x;
  loop invariant 0 <= sn;
  loop assigns x;
  loop assigns sn;
  */
  while (unknown()) {
    x = x + 1;
    sn = sn + 1;
  }
  if(sn != x) {
    //@ assert sn == -1;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type stack_size(const Stack* s);
size_type axiom_size_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  //@ assert StackSize(s) == StackSize{Pre}(s) + 1;
  return stack_size(s);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
/*@
  requires valid:    \valid(s) && StackInvariant(s);
  requires not_full: !StackFull(s);
  assigns            s->size, s->obj[s->size];
  ensures size:      \result == StackSize{Old}(s) + 1;
  ensures valid:     StackInvariant(s);
*/
size_type
axiom_size_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  //@ assert StackSize(s) == StackSize{Pre}(s) + 1;
  return stack_size(s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic IotaGenerate
  {
    predicate
    IotaGenerate(value_type* a, integer n, value_type v) =
      \forall integer i; 0 <= i < n  ==>  a[i] == v+i;
  }
*/
void
iota(value_type* a, size_type n, value_type v)
{
  for (size_type i = 0u; i < n; ++i) {
    a[i] = v++;
  }
}
int main(){
    value_type a[10];
    iota(a, 10, 1);
    //@ assert \forall integer i; 0 <= i < 10 ==> a[i] == i + 1;
    return 0;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic IotaGenerate
  {
    predicate
    IotaGenerate(value_type* a, integer n, value_type v) =
      \forall integer i; 0 <= i < n  ==>  a[i] == v+i;
  }
*/
/*@
  requires valid:    \valid(a + (0..n-1));
  requires limit:    v + n <= VALUE_TYPE_MAX;
  assigns            a[0..n-1];
  ensures increment: IotaGenerate(a, n, v);
*/
void
iota(value_type* a, size_type n, value_type v)
{
  /*@
    loop invariant bound:     0 <= i <= n;
    loop invariant limit:     v == \at(v, Pre) + i;
    loop invariant increment: IotaGenerate(a, i, \at(v, Pre));
    loop assigns i, v, a[0..n-1];
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    a[i] = v++;
  }
}
int main(){
    value_type a[10];
    iota(a, 10, 1);
    //@ assert \forall integer i; 0 <= i < 10 ==> a[i] == i + 1;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int incr_a_by_b(int* a, int const* b){
    *a += *b;
    return *a;
}
void main() {
    int a = 10;
    int b = 20;
    incr_a_by_b(&a, &b);
    //@ assert a == 30;
    //@ assert b == 20;
}

Output:
/*@
    requires \valid(a) && \valid_read(b);
    requires \separated(a, b);
    assigns *a;
    ensures *a == \old(*a) + *b;
    ensures *b == \old(*b);
*/
int incr_a_by_b(int* a, int const* b){
    *a += *b;
    return *a;
}
void main() {
    int a = 10;
    int b = 20;
    incr_a_by_b(&a, &b);
    //@ assert a == 30;
    //@ assert b == 20;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<math.h>
double Sqrt(double x){
	return sqrt(x);
}
int main(){
	double x = 9;
	double y;
	y = Sqrt(x);
	//@assert y == sqrt(x);
	return 0;
}

Output:
#include<math.h>
/*@
	requires \is_finite(x);
	requires x >= -0.;
	ensures \result >= -0.;
	ensures \is_finite(\result);
	ensures \result == sqrt(x);
	assigns \result;
*/
double Sqrt(double x){
	return sqrt(x);
}
int main(){
	double x = 9;
	double y;
	y = Sqrt(x);
	//@assert y == sqrt(x);
	return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
size_type
max_element2(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type max = 0u;
    for (size_type i = 0u; i < n; i++) {
      if (a[max] < a[i]) {
        max = i;
      }
    }
    //@ assert MaxElement(a, n, max);
    return max;
  }
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  assigns            \nothing;
  ensures  result:   0 <= \result <= n;
  behavior empty:
    assumes          n == 0;
    assigns          \nothing;
    ensures result:  \result == 0;
  behavior not_empty:
    assumes          0 < n;
    assigns          \nothing;
    ensures result:  0 <= \result < n;
    ensures max:     MaxElement(a, n, \result);
    ensures first:   StrictUpperBound(a, \result, a[\result]);
  complete behaviors;
  disjoint behaviors;
*/
size_type
max_element2(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type max = 0u;
    /*@
      loop invariant bound:   0 <= i <= n;
      loop invariant max:     0 <= max < n;
      loop invariant upper:   UpperBound(a, i, a[max]);
      loop invariant first:   StrictUpperBound(a, max, a[max]);
      loop assigns max, i;
      loop variant n-i;
    */
    for (size_type i = 0u; i < n; i++) {
      if (a[max] < a[i]) {
        max = i;
      }
    }
    //@ assert MaxElement(a, n, max);
    return max;
  }
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c != n) {
    //@ assert c >= 0;
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c != n) {
    //@ assert c >= 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
*/
/*@
  inductive CountInd{L}(value_type *a, integer n, value_type v, integer sum)
  {
    case Nil{L}:
      \forall value_type *a, v, integer n;
        n <= 0  ==>  CountInd{L}(a, n, v, 0);
    case Hit{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n  &&  a[n-1] == v  &&  CountInd{L}(a, n-1, v, sum)  ==>
        CountInd{L}(a, n, v, sum + 1);
    case Miss{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n  &&  a[n-1] != v  &&  CountInd{L}(a, n-1, v, sum)  ==>
        CountInd{L}(a, n, v, sum);
  }
*/
/*@
  axiomatic CountIndImplicit
  {
    lemma CountInd_Empty{L}:
      \forall value_type *a, v, integer n;
       n <= 0  ==>  CountInd(a, n, v, 0);
    lemma CountInd_Hit{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n                     ==>
        a[n-1] == v               ==>
        CountInd(a, n-1, v, sum)  ==>
        CountInd(a,   n, v, sum+1);
    lemma CountInd_Miss{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n                     ==>
        a[n-1] != v               ==>
        CountInd(a, n-1, v, sum)  ==>
        CountInd(a,   n, v, sum);
  }
*/
/*@
  axiomatic Count
  {
    logic integer
    Count(value_type* a, integer m, integer n, value_type v) =
      n <= m ? 0 : Count(a, m, n-1, v) + (a[n-1] == v ? 1 : 0);
    logic integer
    Count(value_type* a, integer n, value_type v) = Count(a, 0, n, v);
    lemma Count_Empty:
      \forall value_type *a, v, integer m, n;
        n <= m  ==>  Count(a, m, n, v) == 0;
    lemma Count_Hit:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] == v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v) + 1;
    lemma Count_Miss:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] != v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v);
    lemma Count_One:
      \forall value_type *a, v, integer m, n;
        m <= n  ==>  Count(a, m, n+1, v) == Count(a, m, n, v) + Count(a, n, n+1, v);
    lemma Count_Single{K,L}:
      \forall value_type *a, *b, v, integer m, n;
        \at(a[m],K) == \at(b[n],L)  ==>
        Count{K}(a, m, m+1, v) == Count{L}(b, n, n+1, v);
    lemma Count_Single_Bounds:
      \forall value_type *a, v, integer n;
        0 <= Count(a, n, n+1, v) <= 1;
    lemma Count_Single_Shift:
      \forall value_type *a, v, integer n;
        0 <= n  ==>  Count(a+n, 0, 1, v) == Count(a, n, n+1, v);
  }
*/
/*@
  axiomatic CountIndLemmas
  {
    lemma CountInd_Inverse:
      \forall value_type *a, v, integer n, sum;
        CountInd(a, n, v, sum)  ==>
          (n <= 0 && sum == 0) ||
          (0 < n && a[n-1] != v && CountInd(a, n-1, v, sum)) ||
          (0 < n && a[n-1] == v && CountInd(a, n-1, v, sum-1));
  }
*/
size_type
count2(const value_type* a, size_type n, value_type v)
{
  size_type counted = 0u;
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      counted++;
      //@ assert count: CountInd(a, i+1, v, counted);
    }
  }
  return counted;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
*/
/*@
  inductive CountInd{L}(value_type *a, integer n, value_type v, integer sum)
  {
    case Nil{L}:
      \forall value_type *a, v, integer n;
        n <= 0  ==>  CountInd{L}(a, n, v, 0);
    case Hit{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n  &&  a[n-1] == v  &&  CountInd{L}(a, n-1, v, sum)  ==>
        CountInd{L}(a, n, v, sum + 1);
    case Miss{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n  &&  a[n-1] != v  &&  CountInd{L}(a, n-1, v, sum)  ==>
        CountInd{L}(a, n, v, sum);
  }
*/
/*@
  axiomatic CountIndImplicit
  {
    lemma CountInd_Empty{L}:
      \forall value_type *a, v, integer n;
       n <= 0  ==>  CountInd(a, n, v, 0);
    lemma CountInd_Hit{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n                     ==>
        a[n-1] == v               ==>
        CountInd(a, n-1, v, sum)  ==>
        CountInd(a,   n, v, sum+1);
    lemma CountInd_Miss{L}:
      \forall value_type *a, v, integer n, sum;
        0 < n                     ==>
        a[n-1] != v               ==>
        CountInd(a, n-1, v, sum)  ==>
        CountInd(a,   n, v, sum);
  }
*/
/*@
  axiomatic Count
  {
    logic integer
    Count(value_type* a, integer m, integer n, value_type v) =
      n <= m ? 0 : Count(a, m, n-1, v) + (a[n-1] == v ? 1 : 0);
    logic integer
    Count(value_type* a, integer n, value_type v) = Count(a, 0, n, v);
    lemma Count_Empty:
      \forall value_type *a, v, integer m, n;
        n <= m  ==>  Count(a, m, n, v) == 0;
    lemma Count_Hit:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] == v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v) + 1;
    lemma Count_Miss:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] != v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v);
    lemma Count_One:
      \forall value_type *a, v, integer m, n;
        m <= n  ==>  Count(a, m, n+1, v) == Count(a, m, n, v) + Count(a, n, n+1, v);
    lemma Count_Single{K,L}:
      \forall value_type *a, *b, v, integer m, n;
        \at(a[m],K) == \at(b[n],L)  ==>
        Count{K}(a, m, m+1, v) == Count{L}(b, n, n+1, v);
    lemma Count_Single_Bounds:
      \forall value_type *a, v, integer n;
        0 <= Count(a, n, n+1, v) <= 1;
    lemma Count_Single_Shift:
      \forall value_type *a, v, integer n;
        0 <= n  ==>  Count(a+n, 0, 1, v) == Count(a, n, n+1, v);
  }
*/
/*@
  axiomatic CountIndLemmas
  {
    lemma CountInd_Inverse:
      \forall value_type *a, v, integer n, sum;
        CountInd(a, n, v, sum)  ==>
          (n <= 0 && sum == 0) ||
          (0 < n && a[n-1] != v && CountInd(a, n-1, v, sum)) ||
          (0 < n && a[n-1] == v && CountInd(a, n-1, v, sum-1));
  }
*/
/*@
  requires valid: \valid_read(a + (0..n-1));
  assigns         \nothing;
  ensures bound:  0 <= \result <= n;
  ensures count:  CountInd(a, n, v, \result);
*/
size_type
count2(const value_type* a, size_type n, value_type v)
{
  size_type counted = 0u;
  /*@
    loop invariant bound: 0 <= i <= n;
    loop invariant bound: 0 <= counted <= i;
    loop invariant count: CountInd(a, i, v, counted);
    loop assigns i, counted;
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      counted++;
      //@ assert count: CountInd(a, i+1, v, counted);
    }
  }
  return counted;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void main() {
  int x;
  int y;
  x = 1;
  y = 0;
  while (y < 100000) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert  (x >= y) ;
}

Output:
void main() {
  int x;
  int y;
  x = 1;
  y = 0;
  /*@
  loop invariant y <= x;
  loop invariant 0 <= y <= 100000;
  loop invariant 1 <= x;
  loop assigns y,x;
  */
  while (y < 100000) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert  (x >= y) ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
void
stack_pop_wd(Stack* s, Stack* t)
{
  //@ assert StackEqual{Here,Here}(s, t);
  stack_pop(s);
  stack_pop(t);
  //@ assert StackEqual{Here,Here}(s, t);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
  requires valid:  \valid(s) && StackInvariant(s);
  requires valid:  \valid(t) && StackInvariant(t);
  requires equal:  StackEqual{Here,Here}(s, t);
  requires sep:    StackSeparated(s, t);
  assigns          s->size;
  assigns          t->size;
  ensures valid:   StackInvariant(s);
  ensures valid:   StackInvariant(t);
  ensures equal:   StackEqual{Here,Here}(s, t);
*/
void
stack_pop_wd(Stack* s, Stack* t)
{
  //@ assert StackEqual{Here,Here}(s, t);
  stack_pop(s);
  stack_pop(t);
  //@ assert StackEqual{Here,Here}(s, t);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int add(int x, int y) {
    return x+y;
}
void foo() {
    int a = add(1, 43);
    //@ assert a == 44;
    int b = add(INT_MAX, INT_MAX);
}

Output:
#include <limits.h>
/*@
    requires x >= INT_MIN &&  y >= INT_MIN;
    ensures \result == x+y;
*/
int add(int x, int y) {
    return x+y;
}
void foo() {
    int a = add(1, 43);
    //@ assert a == 44;
    int b = add(INT_MAX, INT_MAX);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic SomeNone
  {
    predicate
    SomeEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] == v;
    predicate
    SomeEqual{A}(value_type* a, integer n, value_type v) =
      SomeEqual(a, 0, n, v);
    predicate
    NoneEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] != v;
    predicate
    NoneEqual(value_type* a, integer n, value_type v) =
      NoneEqual(a, 0, n, v);
    lemma NotSomeEqual_NoneEqual:
      \forall value_type *a, v, integer m, n;
        !SomeEqual(a, m, n, v)  ==>  NoneEqual(a, m, n, v);
    lemma NoneEqual_NotSomeEqual:
      \forall value_type *a, v, integer m, n;
       NoneEqual(a, m, n, v)   ==>  !SomeEqual(a, m, n, v);
  }
*/
size_type
find2(const value_type* a, size_type n, value_type v)
{
  for (size_type i = 0u; i < n; i++) {
    if (a[i] == v) {
      //@ assert SomeEqual(a, i+1, v);
      return i;
    }
  }
  //@ assert NoneEqual(a, n, v);
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic SomeNone
  {
    predicate
    SomeEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] == v;
    predicate
    SomeEqual{A}(value_type* a, integer n, value_type v) =
      SomeEqual(a, 0, n, v);
    predicate
    NoneEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] != v;
    predicate
    NoneEqual(value_type* a, integer n, value_type v) =
      NoneEqual(a, 0, n, v);
    lemma NotSomeEqual_NoneEqual:
      \forall value_type *a, v, integer m, n;
        !SomeEqual(a, m, n, v)  ==>  NoneEqual(a, m, n, v);
    lemma NoneEqual_NotSomeEqual:
      \forall value_type *a, v, integer m, n;
       NoneEqual(a, m, n, v)   ==>  !SomeEqual(a, m, n, v);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  assigns            \nothing;
  ensures result:    0 <= \result <= n;
  behavior some:
    assumes          SomeEqual(a, n, v);
    assigns          \nothing;
    ensures  bound:  0 <= \result < n;
    ensures  result: a[\result] == v;
    ensures  first:  NoneEqual(a, \result, v);
  behavior none:
    assumes          NoneEqual(a, n, v);
    assigns          \nothing;
    ensures  result: \result == n;
  complete behaviors;
  disjoint behaviors;
*/
size_type
find2(const value_type* a, size_type n, value_type v)
{
  /*@
    loop invariant bound:     0 <= i <= n;
    loop invariant not_found: NoneEqual(a, i, v);
    loop assigns i;
    loop variant n-i;
   */
  for (size_type i = 0u; i < n; i++) {
    if (a[i] == v) {
      //@ assert SomeEqual(a, i+1, v);
      return i;
    }
  }
  //@ assert NoneEqual(a, n, v);
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i < y) {
    //@ assert 0 <= i;
  }
}

Output:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  /*@
  loop invariant i <= y;
  loop invariant 0 <= i;
  loop assigns i;
  */
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i < y) {
    //@ assert 0 <= i;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x) {
  int lock = 0;
  int y = x + 1;
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x = y;
    } else {
      lock = 0;
      x = y;
      y = y + 1;
    }
  }
  //@ assert lock == 1;
}

Output:
void foo(int x) {
  int lock = 0;
  int y = x + 1;
  /*@
  loop invariant y <= x || x <= y;
  loop invariant x <= y;
  loop invariant x != y || x != y + 1;
  loop invariant lock == 1 || lock != 1;
  loop invariant lock == 1 ==> x == y;
  loop invariant lock == 0 ==> y == x + 1;
  loop invariant lock == 0 ==> x != y;
  loop invariant x == y || x == y - 1;
  loop invariant x == y || x != y;
  loop invariant lock == 1 || lock == 0;
  loop invariant lock == 0 || lock == 1;
  loop invariant lock == 0 ==> lock != 1;
  loop assigns x,y,lock;
  */
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x = y;
    } else {
      lock = 0;
      x = y;
      y = y + 1;
    }
  }
  //@ assert lock == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Replace
  {
    predicate
    Replace{K,L}(value_type* a, integer n, value_type* b,
                 value_type v, value_type w) =
      \forall integer i; 0 <= i < n  ==>
        \let ai = \at(a[i],K);
        \let bi = \at(b[i],L);
        (ai == v  ==>  bi == w) && (ai != v  ==>  bi == ai) ;
    predicate
    Replace{K,L}(value_type* a, integer n, value_type v, value_type w) =
      Replace{K,L}(a, n, a, v, w);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
size_type
replace_copy(const value_type* a, size_type n, value_type* b, value_type v,
             value_type w)
{
  for (size_type i = 0u; i < n; ++i) {
    b[i] = (a[i] == v ? w : a[i]);
  }
  //@ assert Replace{Pre,Here}(a, n, b, v, w);
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Replace
  {
    predicate
    Replace{K,L}(value_type* a, integer n, value_type* b,
                 value_type v, value_type w) =
      \forall integer i; 0 <= i < n  ==>
        \let ai = \at(a[i],K);
        \let bi = \at(b[i],L);
        (ai == v  ==>  bi == w) && (ai != v  ==>  bi == ai) ;
    predicate
    Replace{K,L}(value_type* a, integer n, value_type v, value_type w) =
      Replace{K,L}(a, n, a, v, w);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  requires valid:    \valid(b + (0..n-1));
  requires sep:      \separated(a + (0..n-1), b + (0..n-1));
  assigns            b[0..n-1];
  ensures result:    \result == n;
  ensures replace:   Replace{Old,Here}(a, n, b, v, w);
  ensures unchanged: Unchanged{Old,Here}(a, n);
*/
size_type
replace_copy(const value_type* a, size_type n, value_type* b, value_type v,
             value_type w)
{
  /*@
    loop invariant bounds:    0 <= i <= n;
    loop invariant replace:   Replace{Pre,Here}(a, i, b, v, w);
    loop assigns i, b[0..n-1];
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    b[i] = (a[i] == v ? w : a[i]);
  }
  //@ assert Replace{Pre,Here}(a, n, b, v, w);
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  while (x < n) {
    x  = x + 1;
  }
  //@ assert x == n;
}

Output:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  /*@
  loop invariant x <= n;
  loop invariant 0 <= x;
  loop assigns x;
  */
  while (x < n) {
    x  = x + 1;
  }
  //@ assert x == n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int triangle(int a, int b, int c) {
    if ((a+b+c == 180) && a > 0 && b > 0 && c > 0) {
        return 1;
    } else {
        return 0;
    }
}
void check_validity() {
    int res = triangle(90, 45, 45);
    //@ assert res == 1;
    res = triangle(90, 145, 145);
    //@ assert res == 0;
}

Output:
/*@
    requires a>0 && b>0 && c>0;
    ensures \result == 1 <==> (a+b+c == 180) && (a > 0) && (b > 0) && (c > 0);
    ensures \result == 0 <==> (a+b+c != 180) || (a <= 0) || (b <= 0) || (c <= 0);
*/
int triangle(int a, int b, int c) {
    if ((a+b+c == 180) && a > 0 && b > 0 && c > 0) {
        return 1;
    } else {
        return 0;
    }
}
void check_validity() {
    int res = triangle(90, 45, 45);
    //@ assert res == 1;
    res = triangle(90, 145, 145);
    //@ assert res == 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int area(int base, int height){
    int res = (base *  height)/2;
    return res;
}
int main() {
    int a = area(4, 5);
    //@ assert a == 10;
}

Output:
/*@
    requires base >= 0 && height >= 0;
    ensures \result == (base * height)/2;
*/
int area(int base, int height){
    int res = (base *  height)/2;
    return res;
}
int main() {
    int a = area(4, 5);
    //@ assert a == 10;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int max_ptr(int *a, int *b){
    return (*a < *b) ? *b : *a ;
}
extern int h;
int main() {
    h = 42;
    int a = 24;
    int b = 42;
    int x = max_ptr(&a, &b);
    //@ assert x == 42;
    //@ assert h == 42;
}

Output:
/*@
    requires \valid_read(a) && \valid_read(b);
    requires \separated(a, b);
    assigns \nothing;
    ensures \result >= *a && \result >= *b;
    ensures \result == *a || \result == *b;
*/
int max_ptr(int *a, int *b){
    return (*a < *b) ? *b : *a ;
}
extern int h;
int main() {
    h = 42;
    int a = 24;
    int b = 42;
    int x = max_ptr(&a, &b);
    //@ assert x == 42;
    //@ assert h == 42;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int spec_sign(int x)
{
   return (x > 0) - (x < 0);
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = spec_sign(10);
   //@ assert a == 1;
   int b = spec_sign(0);
   //@ assert b == 0;
}
#endif

Output:
/*@ assigns \nothing;
    ensures \result == 0 || \result == 1 || \result == -1;
    behavior positive:
       assumes x > 0;
       ensures \result == 1;
    behavior zero:
       assumes x == 0;
       ensures \result == 0;
    behavior negative:
       assumes x < 0;
       ensures \result == -1;
    complete behaviors;
    disjoint behaviors;
 */
int spec_sign(int x)
{
   return (x > 0) - (x < 0);
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = spec_sign(10);
   //@ assert a == 1;
   int b = spec_sign(0);
   //@ assert b == 0;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int j, int c, int t) {
    int i = 0;
    while(unknown()) {
        if(c > 48) {
            if (c < 57) {
                j = i + i;
                t = c - 48;
                i = j + t;
            }
        }
    }
    //@ assert i >= 0;
}

Output:
void foo(int j, int c, int t) {
    int i = 0;
    /*@
    loop invariant 0 <= i;
    loop assigns t,j,i,c;
    */
    while(unknown()) {
        if(c > 48) {
            if (c < 57) {
                j = i + i;
                t = c - 48;
                i = j + t;
            }
        }
    }
    //@ assert i >= 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdio.h>
/*@
  axiomatic Factorial {
  logic integer fact(integer n);
  axiom case_n:
    \forall integer n;
    n >= 1 ==> fact(n) == n*fact(n-1);
  axiom case_0:
    fact(0) == 1;
  }
*/
int factorial(int n) {
  int i = 1;
  int f = 1;
  while (i <= n)  {
    f = f * i;
    i = i + 1;
  }
  return f;
}
void main() {
  int t = factorial(5);
  //@ assert t == 120;
}

Output:
#include <stdio.h>
/*@
  axiomatic Factorial {
  logic integer fact(integer n);
  axiom case_n:
    \forall integer n;
    n >= 1 ==> fact(n) == n*fact(n-1);
  axiom case_0:
    fact(0) == 1;
  }
*/
/*@
  requires  n >= 0;
  ensures   \result == fact(n);
  assigns   \nothing ;
*/
int factorial(int n) {
  int i = 1;
  int f = 1;
  /*@
    loop invariant f == fact(i-1);
    loop invariant 0 < i <= n+1;
    loop assigns i, f;
  */
  while (i <= n)  {
    f = f * i;
    i = i + 1;
  }
  return f;
}
void main() {
  int t = factorial(5);
  //@ assert t == 120;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Linear Search problem using behavior

Input:
#include <stddef.h>
int* search(int* array, size_t length, int element) {
	for(size_t i = 0; i < length; i++)
		if(array[i]==element) return &array[i];
	return NULL;
}
void main() {
	int a[] = {1, 5, 6, 7};
	int* res = search(a, 4, 5);
}

Output:
#include <stddef.h>
/*@
	requires \valid_read(array+(0..length-1));
	assigns \nothing;
	behavior in:
		assumes \exists size_t off;0<=off<length&&array[off]==element;
		ensures array<=\result<array+length&&*\result==element;
	behavior notin:
		assumes \forall size_t off;0<=off<length==>array[off]!=element;
		ensures \result==NULL;
	disjoint behaviors;
	complete behaviors;
*/
int* search(int* array, size_t length, int element) {
	/*@
		loop invariant 0<=i<=length;
		loop invariant \forall size_t j;0<=j<i==>array[j]!=element;
		loop assigns i;
		loop variant length-i;
	*/
	for(size_t i = 0; i < length; i++)
		if(array[i]==element) return &array[i];
	return NULL;
}
void main() {
	int a[] = {1, 5, 6, 7};
	int* res = search(a, 4, 5);
	//@ assert *res == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
enum Kind { VOWEL, CONSONANT };
enum Kind kind_of_letter(char c) {
    if (c == 'a' || c == 'e' || c == 'i' || c == 'o' || c == 'u'){
        return VOWEL;
    }
    return CONSONANT;
}
void test(){
    char a = 'a', b = 'b', c = 'c', e = 'e', z = 'z';
    enum Kind kind_a = kind_of_letter(a);
    //@ assert kind_a == VOWEL ;
    enum Kind kind_b = kind_of_letter(b);
    //@ assert kind_b == CONSONANT ;
    enum Kind kind_c = kind_of_letter(c);
    //@ assert kind_c == CONSONANT ;
    enum Kind kind_e = kind_of_letter(e);
    //@ assert kind_e == VOWEL ;
    enum Kind kind_z = kind_of_letter(z);
    //@ assert kind_z == CONSONANT ;
}

Output:
enum Kind { VOWEL, CONSONANT };
/*@
    requires lowercase: 'a' <= c <= 'z' ;
    assigns \nothing ;
    behavior vowel:
        assumes c \in {'a', 'e', 'i', 'o', 'u'} ;
        ensures \result == VOWEL ;
    behavior consonant:
        assumes !(c \in {'a', 'e', 'i', 'o', 'u'}) ;
        ensures \result == CONSONANT ;
    complete behaviors;
    disjoint behaviors;
*/
enum Kind kind_of_letter(char c) {
    if (c == 'a' || c == 'e' || c == 'i' || c == 'o' || c == 'u'){
        return VOWEL;
    }
    return CONSONANT;
}
void test(){
    char a = 'a', b = 'b', c = 'c', e = 'e', z = 'z';
    enum Kind kind_a = kind_of_letter(a);
    //@ assert kind_a == VOWEL ;
    enum Kind kind_b = kind_of_letter(b);
    //@ assert kind_b == CONSONANT ;
    enum Kind kind_c = kind_of_letter(c);
    //@ assert kind_c == CONSONANT ;
    enum Kind kind_e = kind_of_letter(e);
    //@ assert kind_e == VOWEL ;
    enum Kind kind_z = kind_of_letter(z);
    //@ assert kind_z == CONSONANT ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void increment_array_by(int* arr, int n, int c) {
    for (int  i = 0; i < n; i++) {
        arr[i] = arr[i] + c;
    }
}
void main() {
    int arr[5] = {1, 2, 3, 4, 5};
    increment_array_by(arr, 5, 2);
    //@ assert arr[0] == 3;
    //@ assert arr[1] == 4;
    //@ assert arr[2] == 5;
    //@ assert arr[3] == 6;
    //@ assert arr[4] == 7;
}

Output:
/*@
    requires n > 0;
    requires \valid_read(arr+(0..n-1));
    ensures \forall integer k; 0 <= k < n ==> arr[k] == (\at(arr[k], Pre) + c);
*/
void increment_array_by(int* arr, int n, int c) {
    /*@
        loop invariant 0 <= i <= n;
        loop invariant \forall integer k; 0 <= k < i ==> arr[k] == \at(arr[k], Pre) + c;
        loop invariant \forall integer k; i <= k < n ==> arr[k] == \at(arr[k], Pre);
        loop assigns i, arr[0..n-1];
    */
    for (int  i = 0; i < n; i++) {
        arr[i] = arr[i] + c;
    }
}
void main() {
    int arr[5] = {1, 2, 3, 4, 5};
    increment_array_by(arr, 5, 2);
    //@ assert arr[0] == 3;
    //@ assert arr[1] == 4;
    //@ assert arr[2] == 5;
    //@ assert arr[3] == 6;
    //@ assert arr[4] == 7;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
    int x = 1;
    int y = 0;
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
      //@ assert y < n;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
    int x = 1;
    int y = 0;
    /*@
    loop invariant n > 0 ==> y >= 0;
    loop invariant n > 0 ==> y < n;
    loop invariant y <= n;
    loop invariant x <= n+1;
    loop invariant x <= n + 1;
    loop invariant 1 <= x;
    loop invariant 0 <= y;
    loop invariant 0 <= x;
    loop assigns y;
    loop assigns x;
    */
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
      //@ assert y < n;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int i = 1;
  int sn = 0;
  while (i <= 8) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == 8;
  }
}

Output:
int main() {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant i <= 9;
  loop invariant 1 <= i;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= 8) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == 8;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  while (x < n) {
    x = x + 1;
  }
  if (n >= 0) {
    //@ assert x == n;
  }
}

Output:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  /*@
  loop invariant x <= n;
  loop invariant 0 <= x;
  loop assigns x;
  */
  while (x < n) {
    x = x + 1;
  }
  if (n >= 0) {
    //@ assert x == n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n <= -1) {
    //@ assert c != n;
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant \exists integer k; k < 0 && c == n ==> c == 1;
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n <= -1) {
    //@ assert c != n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Binary Search problem using behavior

Input:
#include<stdio.h>
/*@
predicate sorted(int* a, int length)=\forall integer i,j;0<=i<j<length==>a[i]<=a[j];
*/
int binary_search(int* a, int n, int v) {
	int l=0,u=n-1;
	while(l<=u) {
		int m=l+(u-l)/2;
		if(a[m]==v) return m;
		else if(a[m]<v) l=m+1;
		else u=m-1;
	}
	return -1;
}
void main() {
	int a[] = {1, 3, 4, 5, 9};
	int n = sizeof(a) / sizeof(a[0]);
	//@ assert sorted(a + 0, n);
	int res = binary_search(a, n, 5);
	//@ assert res==3;
}

Output:
#include<stdio.h>
/*@
predicate sorted(int* a, int length)=\forall integer i,j;0<=i<j<length==>a[i]<=a[j];
*/
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
  	requires sorted(a,n);
	assigns \nothing;
	behavior exists:
		assumes \exists integer i;0<=i<n&&a[i]==v;
		ensures 0<=\result<n&&a[\result]==v;
	behavior not_exists:
		assumes \forall integer i;0<=i<n==>a[i]!=v;
		ensures \result==-1;
	complete behaviors;
	disjoint behaviors;
*/
int binary_search(int* a, int n, int v) {
	int l=0,u=n-1;
	/*@
		loop invariant 0<=l<=u+1;
		loop invariant u<n;
		loop assigns l,u;
		loop invariant \forall integer k;0<=k<l==>a[k]<v;
		loop invariant \forall integer k;u<k<n==>a[k]>v;
		loop variant u-l;
	*/
	while(l<=u) {
		int m=l+(u-l)/2;
		if(a[m]==v) return m;
		else if(a[m]<v) l=m+1;
		else u=m-1;
	}
	return -1;
}
void main() {
	int a[] = {1, 3, 4, 5, 9};
	int n = sizeof(a) / sizeof(a[0]);
	//@ assert sorted(a + 0, n);
	int res = binary_search(a, n, 5);
	//@ assert res==3;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
size_type
min_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type min = 0u;
    for (size_type i = 0u; i < n; i++) {
      if (a[i] < a[min]) {
        min = i;
      }
    }
    //@ assert MinElement(a, n, min);
    return min;
  }
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
/*@
  requires valid:   \valid_read(a + (0..n-1));
  assigns           \nothing;
  ensures  result:  0 <= \result <= n;
  behavior empty:
    assumes         n == 0;
    assigns         \nothing;
    ensures result: \result == 0;
  behavior not_empty:
    assumes         0 < n;
    assigns         \nothing;
    ensures result: 0 <= \result < n;
    ensures min:    MinElement(a, n, \result);
    ensures first:  StrictLowerBound(a, \result, a[\result]);
  complete behaviors;
  disjoint behaviors;
*/
size_type
min_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type min = 0u;
    /*@
      loop invariant bound:  0 <= i   <= n;
      loop invariant min:    0 <= min <  n;
      loop invariant lower:  LowerBound(a, i, a[min]);
      loop invariant first:  StrictLowerBound(a, min, a[min]);
      loop assigns min, i;
      loop variant n-i;
    */
    for (size_type i = 0u; i < n; i++) {
      if (a[i] < a[min]) {
        min = i;
      }
    }
    //@ assert MinElement(a, n, min);
    return min;
  }
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int distance(int a, int b) {
    if (a < b) return b - a;
    else return a - b;
}
int main(){
    int a = -10;
    int b = 10;
    int result = distance(a, b);
    //@ assert result == 20;
    return 0;
}

Output:
#include <limits.h>
/*@
    requires INT_MIN < a - b < INT_MAX ||
             INT_MIN < b - a < INT_MAX;
    ensures positive_value: function_result: \result >= 0;
    ensures correct_sum: (a - b) >= 0 <==> \result == (a - b) &&
                         (a - b) <= 0 <==> \result == (b - a);
    assigns \nothing;
*/
int distance(int a, int b) {
    if (a < b) return b - a;
    else return a - b;
}
int main(){
    int a = -10;
    int b = 10;
    int result = distance(a, b);
    //@ assert result == 20;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
value_type
axiom_top_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  //@ assert StackTop(s) == v;
  return stack_top(s);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
/*@
  requires valid:     \valid(s) && StackInvariant(s);
  requires not_full:  !StackFull(s);
  assigns             s->size, s->obj[s->size];
  ensures  top:       \result == v;
*/
value_type
axiom_top_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  //@ assert StackTop(s) == v;
  return stack_top(s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void arrayDouble(int *a, unsigned int n) {
    int p = 0;
    while (p < n) {
        a[p] = a[p] * 2;
        p = p + 1;
    }
}
int main() {
    int arr[] = {0,1,2,3,4,5};
    arrayDouble(arr, 6);
    //@ assert arr[0] == 0;
    //@ assert arr[1] == 2;
    //@ assert arr[2] == 4;
    //@ assert arr[3] == 6;
    //@ assert arr[4] == 8;
    //@ assert arr[5] == 10;
}

Output:
/*@
    requires n > 0;
    requires \valid_read(a+(0..n-1));
    ensures \forall integer k; 0 <= k < n ==> a[k] == \old(a[k])*2;
*/
void arrayDouble(int *a, unsigned int n) {
    int p = 0;
    /*@
        loop invariant 0 <= p <= n;
        loop invariant \forall integer k; 0 <= k < p ==> a[k] == \at(a[k], Pre) * 2;
        loop invariant \forall integer k; p <= k < n ==> a[k] == \at(a[k], Pre);
        loop assigns p, a[0..n-1];
        loop variant n - p;
    */
    while (p < n) {
        a[p] = a[p] * 2;
        p = p + 1;
    }
}
int main() {
    int arr[] = {1,3,5,7,8};
    arrayDouble(arr, 5);
    //@ assert arr[0] == 2;
    //@ assert arr[1] == 6;
    //@ assert arr[2] == 10;
    //@ assert arr[3] == 14;
    //@ assert arr[4] == 16;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int diff (int x, int y) {
    return x-y;
}
void main() {
    int t = diff(10, 5);
    //@ assert t == 5;
}

Output:
#include <limits.h>
/*@
    requires (x > INT_MIN) && (y > INT_MIN);
    ensures y == x-\result;
*/
int diff (int x, int y) {
    return x-y;
}
void main() {
    int t = diff(10, 5);
    //@ assert t == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant 0 <= c <= n;
  loop invariant c <= n || 0 < n;
  loop invariant 0 < n;
  loop invariant (c == n || c != n);
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
unsigned lower_bound(const int *a, unsigned n, int val)
{
	unsigned left = 0;
	unsigned right = n;
	unsigned middle = 0;
	while (left < right) {
		middle = left + (right - left) / 2;
		if (a[middle] < val) {
			//@ assert \forall integer i; 0 <= i < middle+1 ==> a[i] < val;
			left = middle + 1;
		} else right = middle;
	}
	return left;
}
int main(){
	unsigned n = 5;
	int a[5] = {1, 2, 3, 4, 5};
	unsigned result = lower_bound(a, n, 3);
	//@ assert result == 2;
	return 0;
}

Output:
/*@ requires \valid(a + (0..n-1));
    requires \forall integer i, integer j; 0 <= i < j < n ==> a[i] <= a[j];
    assigns \nothing;
    ensures 0 <= \result <= n;
    ensures \forall integer k; 0 <= k < \result ==> a[k] < val;
    ensures \forall integer k; \result <= k < n ==> val <= a[k];
*/
unsigned lower_bound(const int *a, unsigned n, int val)
{
	unsigned left = 0;
	unsigned right = n;
	unsigned middle = 0;
	/*@ loop invariant 0 <= left <= right <= n;
	    loop assigns middle, left, right;
	    loop invariant \forall integer i; 0 <= i < left ==> a[i] < val;
	    loop invariant \forall integer i; right <= i < n ==> val <= a[i];
	    loop variant right - left;
	  */
	while (left < right) {
		middle = left + (right - left) / 2;
		if (a[middle] < val) {
			//@ assert \forall integer i; 0 <= i < middle+1 ==> a[i] < val;
			left = middle + 1;
		} else right = middle;
	}
	return left;
}
int main(){
	unsigned n = 5;
	int a[5] = {1, 2, 3, 4, 5};
	unsigned result = lower_bound(a, n, 3);
	//@ assert result == 2;
	return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.