/* Generated by Frama-C */
extern int g_calls ;
int g(int x ) ;
void h(void) ;
extern int random() ;
extern int NB ;
extern int G_i ;
enum aorai_States {
    S5 = 4,
    S4 = 6,
    S3 = 5,
    S2 = 3,
    S1 = 0,
    OK = 2,
    S0 = 1
} ;
//****************
//* BEGIN Primitives generated for LTL verification
//* 
//* States and Trans Variables
int aorai_CurStates[7]  = {1, 0, 0, 0, 0, 0, 0};
int aorai_CurTrans[9]  =   
                           {1, 0, 0, 0, 0, 0, 0, 0, 0};
int aorai_CurStates_old[7]  = {0, 1, 0, 0, 0, 0, 0};
//* 
//* 
//* Some constants
enum aorai_ListOper {
    op_g = 2,
    op_f = 1,
    op_h = 0
} ;
enum aorai_ListOper aorai_CurOperation  = op_f;
enum aorai_OpStatusList {
    aorai_Terminated = 1,
    aorai_Called = 0
} ;
enum aorai_OpStatusList aorai_CurOpStatus  = aorai_Called;
//* 
//* Loops management
int aorai_Loop_Init_38  = 0;
//* 
//**************** 
//* Axiomatized transitions automata
/*@
axiomatic
  aorai_Trans_Start {
  logic integer aorai_Trans_Start(integer tr) ;
  
  axiom aorai_Trans_Start0: (aorai_Trans_Start(0) == 1);
  
  axiom aorai_Trans_Start1: (aorai_Trans_Start(1) == 0);
  
  axiom aorai_Trans_Start2: (aorai_Trans_Start(2) == 0);
  
  axiom aorai_Trans_Start3: (aorai_Trans_Start(3) == 3);
  
  axiom aorai_Trans_Start4: (aorai_Trans_Start(4) == 3);
  
  axiom aorai_Trans_Start5: (aorai_Trans_Start(5) == 3);
  
  axiom aorai_Trans_Start6: (aorai_Trans_Start(6) == 5);
  
  axiom aorai_Trans_Start7: (aorai_Trans_Start(7) == 6);
  
  axiom aorai_Trans_Start8: (aorai_Trans_Start(8) == 4);
  
  }
 */
/*@
axiomatic
  aorai_Trans_Stop {
  logic integer aorai_Trans_Stop(integer tr) ;
  
  axiom aorai_Trans_Stop0: (aorai_Trans_Stop(0) == 0);
  
  axiom aorai_Trans_Stop1: (aorai_Trans_Stop(1) == 2);
  
  axiom aorai_Trans_Stop2: (aorai_Trans_Stop(2) == 3);
  
  axiom aorai_Trans_Stop3: (aorai_Trans_Stop(3) == 0);
  
  axiom aorai_Trans_Stop4: (aorai_Trans_Stop(4) == 4);
  
  axiom aorai_Trans_Stop5: (aorai_Trans_Stop(5) == 5);
  
  axiom aorai_Trans_Stop6: (aorai_Trans_Stop(6) == 6);
  
  axiom aorai_Trans_Stop7: (aorai_Trans_Stop(7) == 4);
  
  axiom aorai_Trans_Stop8: (aorai_Trans_Stop(8) == 2);
  
  }
 */
/*@
predicate aorai_Trans_Cond_param{L}(integer _aorai_numTrans, integer
                                   _aorai_op, integer _aorai_status) =
  (((_aorai_numTrans == 0) ==>
   ((_aorai_op == op_f) && (_aorai_status == aorai_Called)))
  &&
  (((_aorai_numTrans == 1) ==>
   (((_aorai_op == op_f) && (_aorai_status == aorai_Terminated)) && (NB <= 0)))
  &&
  (((_aorai_numTrans == 2) ==>
   (((((_aorai_op == op_g) && (_aorai_status == aorai_Called)) && (NB > 0)) &&
    (g_calls < NB))
   && (0 <= g_calls)))
  &&
  (((_aorai_numTrans == 3) ==>
   (((G_i == 0) && (g_calls < NB)) &&
   ((_aorai_op == op_g) && (_aorai_status == aorai_Terminated))))
  &&
  (((_aorai_numTrans == 4) ==>
   (((G_i == 0) && (g_calls == NB)) &&
   ((_aorai_op == op_g) && (_aorai_status == aorai_Terminated))))
  &&
  (((_aorai_numTrans == 5) ==>
   ((G_i != 0) &&
   ((_aorai_op == op_g) && (_aorai_status == aorai_Terminated))))
  &&
  (((_aorai_numTrans == 6) ==>
   ((_aorai_op == op_h) && (_aorai_status == aorai_Called)))
  &&
  (((_aorai_numTrans == 7) ==>
   ((_aorai_op == op_h) && (_aorai_status == aorai_Terminated)))
  &&
  ((_aorai_numTrans == 8) ==>
  ((_aorai_op == op_f) && (_aorai_status == aorai_Terminated)))))))))));
 */
/*@
predicate aorai_Trans_Cond{L}(integer _aorai_numTrans) =
  aorai_Trans_Cond_param{L}(_aorai_numTrans, aorai_CurOperation,
                           aorai_CurOpStatus);

*/
//* 
//**************** 
//* Safety invariants
//* 
//* Inv 2.1 : Not crossable transitions (cond = false) are not crossed over
/*@
global
invariant _Buch_not_crossable_cond:
                                   (\forall integer _buch_tr;
                                   ((((0 <= _buch_tr) && (_buch_tr < 9)) &&
                                    !(aorai_Trans_Cond(_buch_tr)))
                                   ==> (aorai_CurTrans[_buch_tr] == 0)));

*/
//* Inv 2.2 : Not crossable transitions (start state not active) are not crossed over
/*@
global
invariant _Buch_not_crossable_start:
                                    (\forall integer _buch_tr;
                                    ((((0 <= _buch_tr) && (_buch_tr < 9)) &&
                                     (aorai_CurStates_old[aorai_Trans_Start
                                      (_buch_tr)]
                                     == 0))
                                    ==> (aorai_CurTrans[_buch_tr] == 0)));
 */
//* Inv 4 : Each not reachable state is not reached
/*@
global
invariant _Buch_not_reachable:
                              (\forall integer _buch_st;
                              ((((0 <= _buch_st) && (_buch_st < 7)) &&
                               (\forall integer _buch_tr;
                               (((0 <= _buch_tr) && (_buch_tr < 9)) ==>
                               ((aorai_CurTrans[_buch_tr] == 0) ||
                               (aorai_Trans_Stop(_buch_tr) != _buch_st)))))
                              ==> (aorai_CurStates[_buch_st] == 0)));

*/
//* 
//* END Primitives generated for LTL verification
//****************
/*@ requires ((((((((0 == aorai_CurTrans[0]) && (0 == aorai_CurTrans[1])) &&
                  (0 == aorai_CurTrans[3]))
                 && (0 == aorai_CurTrans[4]))
                && (0 == aorai_CurTrans[5]))
               && (0 == aorai_CurTrans[6]))
              && (0 == aorai_CurTrans[7]))
             && (0 == aorai_CurTrans[8]));
    requires (0 != aorai_CurTrans[2]);
    requires ((((((0 == aorai_CurStates[S1]) && (0 == aorai_CurStates[S0])) &&
                (0 == aorai_CurStates[OK]))
               && (0 == aorai_CurStates[S5]))
              && (0 == aorai_CurStates[S3]))
             && (0 == aorai_CurStates[S4]));
    requires (0 != aorai_CurStates[S2]);
    requires ((aorai_CurTrans[2] != 0) ==>
             (((NB > 0) && (g_calls < NB)) && (0 <= g_calls)));
    behavior Buchi_property_behavior_3:
      ensures (((aorai_CurTrans[5] != 0) ==> (G_i != 0)) &&
              (((aorai_CurTrans[4] != 0) ==> ((G_i == 0) && (g_calls == NB)))
              &&
              ((aorai_CurTrans[3] != 0) ==> ((G_i == 0) && (g_calls < NB)))));
      ensures ((((((0 == aorai_CurTrans[0]) && (0 == aorai_CurTrans[1])) &&
                 (0 == aorai_CurTrans[2]))
                && (0 == aorai_CurTrans[6]))
               && (0 == aorai_CurTrans[7]))
              && (0 == aorai_CurTrans[8]));
      ensures (((0 != aorai_CurTrans[3]) || (0 != aorai_CurTrans[4])) ||
              (0 != aorai_CurTrans[5]));
      ensures ((((0 == aorai_CurStates[S0]) && (0 == aorai_CurStates[OK])) &&
               (0 == aorai_CurStates[S2]))
              && (0 == aorai_CurStates[S4]));
      ensures (((0 != aorai_CurStates[S1]) || (0 != aorai_CurStates[S5])) ||
              (0 != aorai_CurStates[S3]));
      
    behavior default:
      ensures (g_calls == \old(g_calls)+1);
      assigns g_calls;
  
*/
int g(int x ) 
{
  int tmp ;
  g_calls ++;
  tmp = random();
  aorai_CurOperation = op_g;
  aorai_CurOpStatus = aorai_Terminated;
  aorai_CurStates_old[S5] = 0;
  aorai_CurStates_old[S4] = 0;
  aorai_CurStates_old[S3] = 0;
  aorai_CurStates_old[S2] = aorai_CurStates[3];
  aorai_CurStates_old[S1] = 0;
  aorai_CurStates_old[OK] = 0;
  aorai_CurStates_old[S0] = 0;
  aorai_CurTrans[0] = 0;
  aorai_CurTrans[1] = 0;
  aorai_CurTrans[2] = 0;
  aorai_CurTrans[3] = (G_i == 0 && g_calls < NB) && aorai_CurStates_old[3];
  aorai_CurTrans[4] = (G_i == 0 && g_calls == NB) && aorai_CurStates_old[3];
  aorai_CurTrans[5] = G_i != 0 && aorai_CurStates_old[3];
  aorai_CurTrans[6] = 0;
  aorai_CurTrans[7] = 0;
  aorai_CurTrans[8] = 0;
  aorai_CurStates[S5] = aorai_CurTrans[4];
  aorai_CurStates[S4] = 0;
  aorai_CurStates[S3] = aorai_CurTrans[5];
  aorai_CurStates[S2] = 0;
  aorai_CurStates[S1] = aorai_CurTrans[3];
  aorai_CurStates[OK] = 0;
  aorai_CurStates[S0] = 0;
  return (tmp);
}

/*@ requires ((((((((0 == aorai_CurTrans[0]) && (0 == aorai_CurTrans[1])) &&
                  (0 == aorai_CurTrans[2]))
                 && (0 == aorai_CurTrans[3]))
                && (0 == aorai_CurTrans[4]))
               && (0 == aorai_CurTrans[5]))
              && (0 == aorai_CurTrans[7]))
             && (0 == aorai_CurTrans[8]));
    requires (0 != aorai_CurTrans[6]);
    requires ((((((0 == aorai_CurStates[S1]) && (0 == aorai_CurStates[S0])) &&
                (0 == aorai_CurStates[OK]))
               && (0 == aorai_CurStates[S2]))
              && (0 == aorai_CurStates[S5]))
             && (0 == aorai_CurStates[S3]));
    requires (0 != aorai_CurStates[S4]);
    behavior Buchi_property_behavior_6:
      ensures ((((((((0 == aorai_CurTrans[0]) && (0 == aorai_CurTrans[1])) &&
                   (0 == aorai_CurTrans[2]))
                  && (0 == aorai_CurTrans[3]))
                 && (0 == aorai_CurTrans[4]))
                && (0 == aorai_CurTrans[5]))
               && (0 == aorai_CurTrans[6]))
              && (0 == aorai_CurTrans[8]));
      ensures (0 != aorai_CurTrans[7]);
      ensures ((((((0 == aorai_CurStates[S1]) && (0 == aorai_CurStates[S0]))
                 && (0 == aorai_CurStates[OK]))
                && (0 == aorai_CurStates[S2]))
               && (0 == aorai_CurStates[S3]))
              && (0 == aorai_CurStates[S4]));
      ensures (0 != aorai_CurStates[S5]);
      
    behavior default:
      assigns \nothing;
  
*/
void h(void) 
{
  aorai_CurOperation = op_h;
  aorai_CurOpStatus = aorai_Terminated;
  aorai_CurStates_old[S5] = 0;
  aorai_CurStates_old[S4] = aorai_CurStates[6];
  aorai_CurStates_old[S3] = 0;
  aorai_CurStates_old[S2] = 0;
  aorai_CurStates_old[S1] = 0;
  aorai_CurStates_old[OK] = 0;
  aorai_CurStates_old[S0] = 0;
  aorai_CurTrans[0] = 0;
  aorai_CurTrans[1] = 0;
  aorai_CurTrans[2] = 0;
  aorai_CurTrans[3] = 0;
  aorai_CurTrans[4] = 0;
  aorai_CurTrans[5] = 0;
  aorai_CurTrans[6] = 0;
  aorai_CurTrans[7] = aorai_CurStates_old[6];
  aorai_CurTrans[8] = 0;
  aorai_CurStates[S5] = aorai_CurTrans[7];
  aorai_CurStates[S4] = 0;
  aorai_CurStates[S3] = 0;
  aorai_CurStates[S2] = 0;
  aorai_CurStates[S1] = 0;
  aorai_CurStates[OK] = 0;
  aorai_CurStates[S0] = 0;
  return;
}

/*@ requires ((((((((0 == aorai_CurTrans[1]) && (0 == aorai_CurTrans[2])) &&
                  (0 == aorai_CurTrans[3]))
                 && (0 == aorai_CurTrans[4]))
                && (0 == aorai_CurTrans[5]))
               && (0 == aorai_CurTrans[6]))
              && (0 == aorai_CurTrans[7]))
             && (0 == aorai_CurTrans[8]));
    requires (0 != aorai_CurTrans[0]);
    requires ((((((0 == aorai_CurStates[S0]) && (0 == aorai_CurStates[OK])) &&
                (0 == aorai_CurStates[S2]))
               && (0 == aorai_CurStates[S5]))
              && (0 == aorai_CurStates[S3]))
             && (0 == aorai_CurStates[S4]));
    requires (0 != aorai_CurStates[S1]);
    behavior Buchi_property_behavior_0:
      ensures ((aorai_CurTrans[1] != 0) ==> (NB <= 0));
      ensures (((((((0 == aorai_CurTrans[0]) && (0 == aorai_CurTrans[2])) &&
                  (0 == aorai_CurTrans[3]))
                 && (0 == aorai_CurTrans[4]))
                && (0 == aorai_CurTrans[5]))
               && (0 == aorai_CurTrans[6]))
              && (0 == aorai_CurTrans[7]));
      ensures ((0 != aorai_CurTrans[1]) || (0 != aorai_CurTrans[8]));
      ensures ((((((0 == aorai_CurStates[S1]) && (0 == aorai_CurStates[S0]))
                 && (0 == aorai_CurStates[S2]))
                && (0 == aorai_CurStates[S5]))
               && (0 == aorai_CurStates[S3]))
              && (0 == aorai_CurStates[S4]));
      ensures (0 != aorai_CurStates[OK]);
      
  
*/
void f(int N ) 
{
  int i ;
  int t ;
  i = 0;
  t = 0;
  { /*undefined sequence*/  G_i = 0; g_calls = G_i; }
  NB = N;
  aorai_Loop_Init_38 = 1;
  /*@ loop invariant
        ((((0 != aorai_CurStates[S1]) || (0 != aorai_CurStates[S5])) ||
         (0 != aorai_CurStates[S3]))
        &&
        (((((0 == aorai_CurStates[S0]) && (0 == aorai_CurStates[OK])) &&
          (0 == aorai_CurStates[S2]))
         && (0 == aorai_CurStates[S4]))
        &&
        (((((0 != aorai_CurTrans[0]) || (0 != aorai_CurTrans[3])) ||
          (0 != aorai_CurTrans[4]))
         || (0 != aorai_CurTrans[5]))
        &&
        (((((0 == aorai_CurTrans[1]) && (0 == aorai_CurTrans[2])) &&
          (0 == aorai_CurTrans[6]))
         && (0 == aorai_CurTrans[7]))
        && (0 == aorai_CurTrans[8])))));
      loop invariant
        ((aorai_Loop_Init_38 != 0) ==>
        ((aorai_CurStates[4] == 0) &&
        ((aorai_CurStates[5] == 0) &&
        ((aorai_CurTrans[3] == 0) &&
        ((aorai_CurTrans[4] == 0) && (aorai_CurTrans[5] == 0))))));
      loop invariant ((aorai_Loop_Init_38 == 0) ==> (aorai_CurTrans[0] == 0));
  */
  while (1) {
    if (i < N) { if (! (! t)) { goto while_0_break; } }
    else { goto while_0_break; }
    aorai_Loop_Init_38 = 0;
    aorai_CurOperation = op_g;
    aorai_CurOpStatus = aorai_Called;
    aorai_CurStates_old[S5] = 0;
    aorai_CurStates_old[S4] = 0;
    aorai_CurStates_old[S3] = 0;
    aorai_CurStates_old[S2] = 0;
    aorai_CurStates_old[S1] = aorai_CurStates[0];
    aorai_CurStates_old[OK] = 0;
    aorai_CurStates_old[S0] = 0;
    aorai_CurTrans[0] = 0;
    aorai_CurTrans[1] = 0;
    aorai_CurTrans[2] = ((NB > 0 && g_calls < NB) && 0 <= g_calls) && aorai_CurStates_old[0];
    aorai_CurTrans[3] = 0;
    aorai_CurTrans[4] = 0;
    aorai_CurTrans[5] = 0;
    aorai_CurTrans[6] = 0;
    aorai_CurTrans[7] = 0;
    aorai_CurTrans[8] = 0;
    aorai_CurStates[S5] = 0;
    aorai_CurStates[S4] = 0;
    aorai_CurStates[S3] = 0;
    aorai_CurStates[S2] = aorai_CurTrans[2];
    aorai_CurStates[S1] = 0;
    aorai_CurStates[OK] = 0;
    aorai_CurStates[S0] = 0;
    t = g(i);
    G_i = t;
    i ++;
    g_calls = i;
  }
  while_0_break: /* internal */ ;
  if (t) {
    aorai_CurOperation = op_h;
    aorai_CurOpStatus = aorai_Called;
    aorai_CurStates_old[S5] = 0;
    aorai_CurStates_old[S4] = 0;
    aorai_CurStates_old[S3] = aorai_CurStates[5];
    aorai_CurStates_old[S2] = 0;
    aorai_CurStates_old[S1] = 0;
    aorai_CurStates_old[OK] = 0;
    aorai_CurStates_old[S0] = 0;
    aorai_CurTrans[0] = 0;
    aorai_CurTrans[1] = 0;
    aorai_CurTrans[2] = 0;
    aorai_CurTrans[3] = 0;
    aorai_CurTrans[4] = 0;
    aorai_CurTrans[5] = 0;
    aorai_CurTrans[6] = aorai_CurStates_old[5];
    aorai_CurTrans[7] = 0;
    aorai_CurTrans[8] = 0;
    aorai_CurStates[S5] = 0;
    aorai_CurStates[S4] = aorai_CurTrans[6];
    aorai_CurStates[S3] = 0;
    aorai_CurStates[S2] = 0;
    aorai_CurStates[S1] = 0;
    aorai_CurStates[OK] = 0;
    aorai_CurStates[S0] = 0;
    h();
  }
  aorai_CurOperation = op_f;
  aorai_CurOpStatus = aorai_Terminated;
  aorai_CurStates_old[S5] = aorai_CurStates[4];
  aorai_CurStates_old[S4] = 0;
  aorai_CurStates_old[S3] = 0;
  aorai_CurStates_old[S2] = 0;
  aorai_CurStates_old[S1] = aorai_CurStates[0];
  aorai_CurStates_old[OK] = 0;
  aorai_CurStates_old[S0] = 0;
  aorai_CurTrans[0] = 0;
  aorai_CurTrans[1] = NB <= 0 && aorai_CurStates_old[0];
  aorai_CurTrans[2] = 0;
  aorai_CurTrans[3] = 0;
  aorai_CurTrans[4] = 0;
  aorai_CurTrans[5] = 0;
  aorai_CurTrans[6] = 0;
  aorai_CurTrans[7] = 0;
  aorai_CurTrans[8] = aorai_CurStates_old[4];
  aorai_CurStates[S5] = 0;
  aorai_CurStates[S4] = 0;
  aorai_CurStates[S3] = 0;
  aorai_CurStates[S2] = 0;
  aorai_CurStates[S1] = 0;
  aorai_CurStates[OK] = aorai_CurTrans[8] || aorai_CurTrans[1];
  aorai_CurStates[S0] = 0;
  return;
}

