[kernel] Parsing FRAMAC_SHARE/libc/__fc_builtin_for_normalization.i (no preprocessing)
[kernel] Parsing tests/aorai/formals.i (no preprocessing)
[aorai] Welcome to the Aorai plugin
[kernel] Parsing FRAMAC_SHARE/libc/__fc_builtin_for_normalization.i (no preprocessing)
[kernel] Parsing /tmp/aorai_formals0.i (no preprocessing)
/* Generated by Frama-C */
enum aorai_States {
    aorai_reject_state = -2,
    OK = 0,
    aorai_intermediate_state = 1,
    aorai_intermediate_state_0 = 2,
    aorai_intermediate_state_1 = 3,
    aorai_intermediate_state_2 = 4,
    aorai_reject = 5,
    init = 6,
    main_0 = 7
};
enum aorai_ListOper {
    op_f = 2,
    op_g = 1,
    op_main = 0
};
enum aorai_OpStatusList {
    aorai_Terminated = 1,
    aorai_Called = 0
};
/*@ lemma init_deterministic_trans{L}: \true;
 */
/*@ lemma aorai_reject_deterministic_trans{L}: \true;
 */
/*@ lemma OK_deterministic_trans{L}: \true;
 */
/*@ ghost enum aorai_ListOper aorai_CurOperation = op_main; */
/*@ ghost enum aorai_OpStatusList aorai_CurOpStatus = aorai_Called; */
/*@
lemma main_0_deterministic_trans{L}:
  ∀ int x;
    ¬(x ≡ 3 ∧ \at(aorai_CurOperation,L) ≡ op_f ∧
       \at(aorai_CurOpStatus,L) ≡ aorai_Called ∧ x ≡ 1 ∧
       \at(aorai_CurOperation,L) ≡ op_f ∧
       \at(aorai_CurOpStatus,L) ≡ aorai_Called);
 */
/*@
lemma aorai_intermediate_state_0_deterministic_trans{L}:
  ¬(\at(aorai_CurOperation,L) ≡ op_g ∧
     \at(aorai_CurOpStatus,L) ≡ aorai_Called ∧
     ¬(\at(aorai_CurOperation,L) ≡ op_g ∧
        \at(aorai_CurOpStatus,L) ≡ aorai_Called));
 */
/*@ ghost int aorai_CurStates = init; */
/*@ ghost int aorai_x_0 = 0; */
/*@
lemma aorai_intermediate_state_2_deterministic_trans{L}:
  ¬(\at(aorai_x_0,L) ≡ 3 ∧ \at(aorai_CurOperation,L) ≡ op_f ∧
     \at(aorai_CurOpStatus,L) ≡ aorai_Terminated ∧
     (¬(\at(aorai_CurOperation,L) ≡ op_f ∧
         \at(aorai_CurOpStatus,L) ≡ aorai_Terminated) ∨
      \at(aorai_x_0,L) ≢ 3));
 */
/*@ ghost int aorai_y = 0; */
/*@
lemma aorai_intermediate_state_1_deterministic_trans{L}:
  ¬(\at(aorai_y,L) ≡ 2 ∧ \at(aorai_CurOperation,L) ≡ op_g ∧
     \at(aorai_CurOpStatus,L) ≡ aorai_Terminated ∧
     (¬(\at(aorai_CurOperation,L) ≡ op_g ∧
         \at(aorai_CurOpStatus,L) ≡ aorai_Terminated) ∨
      \at(aorai_y,L) ≢ 2));
 */
/*@ ghost int aorai_x = 0; */
/*@
lemma aorai_intermediate_state_deterministic_trans{L}:
  ¬(\at(aorai_x,L) ≡ 1 ∧ \at(aorai_CurOperation,L) ≡ op_f ∧
     \at(aorai_CurOpStatus,L) ≡ aorai_Terminated ∧
     (¬(\at(aorai_CurOperation,L) ≡ op_f ∧
         \at(aorai_CurOpStatus,L) ≡ aorai_Terminated) ∨
      \at(aorai_x,L) ≢ 1));
 */
/*@ ensures aorai_CurOpStatus ≡ aorai_Called;
    ensures aorai_CurOperation ≡ op_f;
    assigns aorai_x_0, aorai_x, aorai_CurOpStatus, aorai_CurOperation,
            aorai_CurStates;
    
    behavior buch_state_OK_out:
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_in_0:
      assumes aorai_CurStates ≡ main_0 ∧ x ≡ 1;
      ensures aorai_CurStates ≡ aorai_intermediate_state;
      ensures aorai_x ≡ \old(x);
    
    behavior buch_state_aorai_intermediate_state_out:
      assumes aorai_CurStates ≢ main_0 ∨ ¬(x ≡ 1);
      ensures aorai_CurStates ≢ aorai_intermediate_state;
      ensures aorai_x ≡ \old(aorai_x);
    
    behavior buch_state_aorai_intermediate_state_0_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
    
    behavior buch_state_aorai_intermediate_state_2_in_0:
      assumes aorai_CurStates ≡ main_0 ∧ x ≡ 3;
      ensures aorai_CurStates ≡ aorai_intermediate_state_2;
      ensures aorai_x_0 ≡ \old(x);
    
    behavior buch_state_aorai_intermediate_state_2_out:
      assumes aorai_CurStates ≢ main_0 ∨ ¬(x ≡ 3);
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
      ensures aorai_x_0 ≡ \old(aorai_x_0);
    
    behavior buch_state_aorai_reject_out:
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_out:
      ensures aorai_CurStates ≢ main_0;
 */
extern void f_pre_func(int x);

/*@ requires
      aorai_CurStates ≡ aorai_intermediate_state ∨
      aorai_CurStates ≡ aorai_intermediate_state_2;
    requires
      aorai_CurStates ≡ aorai_intermediate_state ⇒
      aorai_x ≡ 1 ∨ aorai_x ≢ 1;
    requires
      aorai_CurStates ≡ aorai_intermediate_state_2 ⇒
      aorai_x_0 ≡ 3 ∨ aorai_x_0 ≢ 3;
    ensures aorai_CurOpStatus ≡ aorai_Terminated;
    ensures aorai_CurOperation ≡ op_f;
    assigns aorai_CurOpStatus, aorai_CurOperation, aorai_CurStates;
    
    behavior buch_state_OK_in:
      assumes
        aorai_CurStates ≡ aorai_intermediate_state_2 ∧ aorai_x_0 ≡ 3;
      ensures aorai_CurStates ≡ OK;
    
    behavior buch_state_OK_out:
      assumes
        aorai_CurStates ≢ aorai_intermediate_state_2 ∨
        ¬(aorai_x_0 ≡ 3);
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state;
    
    behavior buch_state_aorai_intermediate_state_0_in:
      assumes aorai_CurStates ≡ aorai_intermediate_state ∧ aorai_x ≡ 1;
      ensures aorai_CurStates ≡ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_0_out:
      assumes
        aorai_CurStates ≢ aorai_intermediate_state ∨ ¬(aorai_x ≡ 1);
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
    
    behavior buch_state_aorai_intermediate_state_2_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
    
    behavior buch_state_aorai_reject_in:
      assumes
        (aorai_CurStates ≡ aorai_intermediate_state_2 ∧ aorai_x_0 ≢ 3) ∨
        (aorai_CurStates ≡ aorai_intermediate_state ∧ aorai_x ≢ 1);
      ensures aorai_CurStates ≡ aorai_reject;
    
    behavior buch_state_aorai_reject_out:
      assumes
        (aorai_CurStates ≢ aorai_intermediate_state_2 ∨
         ¬(aorai_x_0 ≢ 3)) ∧
        (aorai_CurStates ≢ aorai_intermediate_state ∨ ¬(aorai_x ≢ 1));
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_out:
      ensures aorai_CurStates ≢ main_0;
 */
extern void f_post_func(int res);

/*@ requires aorai_CurStates ≡ main_0;
    requires aorai_CurStates ≡ main_0 ⇒ x ≡ 1 ∨ x ≡ 3;
    ensures
      aorai_CurStates ≡ aorai_intermediate_state_0 ∨
      aorai_CurStates ≡ OK;
    ensures
      \old(aorai_CurStates ≡ main_0) ⇒
      aorai_CurStates ≢ OK ∧ aorai_CurStates ≢ aorai_reject ⇒
      aorai_x_0 ≡ \old(aorai_x_0);
    ensures
      \old(aorai_CurStates ≡ main_0) ⇒
      aorai_CurStates ≢ aorai_intermediate_state_0 ∧
      aorai_CurStates ≢ aorai_reject ⇒ aorai_x ≡ \old(aorai_x);
    
    behavior Buchi_behavior_in_1:
      assumes aorai_CurStates ≡ main_0 ∧ x ≡ 3;
      ensures
        (aorai_CurStates ≡ OK ⇒ aorai_x_0 ≡ 3) ∧
        (aorai_CurStates ≡ aorai_intermediate_state_0 ⇒ aorai_x ≡ 1) ∧
        (aorai_CurStates ≡ aorai_reject ⇒
         aorai_x ≢ 1 ∨ aorai_x_0 ≢ 3);
      ensures aorai_CurStates ≡ OK ∨ aorai_CurStates ≡ aorai_reject;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x_0 ≡ \at(x,Pre)+0 ∨ aorai_x_0 ≡ \at(aorai_x_0,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x ≡ \at(x,Pre)+0 ∨ aorai_x ≡ \at(aorai_x,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧ aorai_CurStates ≡ OK ⇒
        aorai_x_0 ≡ \at(x,Pre)+0;
    
    behavior Buchi_behavior_in_0:
      assumes aorai_CurStates ≡ main_0 ∧ x ≡ 1;
      ensures
        (aorai_CurStates ≡ OK ⇒ aorai_x_0 ≡ 3) ∧
        (aorai_CurStates ≡ aorai_intermediate_state_0 ⇒ aorai_x ≡ 1) ∧
        (aorai_CurStates ≡ aorai_reject ⇒
         aorai_x ≢ 1 ∨ aorai_x_0 ≢ 3);
      ensures
        aorai_CurStates ≡ aorai_intermediate_state_0 ∨
        aorai_CurStates ≡ aorai_reject;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x_0 ≡ \at(x,Pre)+0 ∨ aorai_x_0 ≡ \at(aorai_x_0,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x ≡ \at(x,Pre)+0 ∨ aorai_x ≡ \at(aorai_x,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ main_0,Pre) ∧
        aorai_CurStates ≡ aorai_intermediate_state_0 ⇒
        aorai_x ≡ \at(x,Pre)+0;
 */
int f(int x)
{
  f_pre_func(x);
  f_post_func(x);
  return x;
}

/*@ ensures aorai_CurOpStatus ≡ aorai_Called;
    ensures aorai_CurOperation ≡ op_g;
    assigns aorai_y, aorai_CurOpStatus, aorai_CurOperation, aorai_CurStates;
    
    behavior buch_state_OK_in:
      assumes aorai_CurStates ≡ OK;
      ensures aorai_CurStates ≡ OK;
    
    behavior buch_state_OK_out:
      assumes aorai_CurStates ≢ OK;
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state;
    
    behavior buch_state_aorai_intermediate_state_0_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_in_0:
      assumes aorai_CurStates ≡ aorai_intermediate_state_0;
      ensures aorai_CurStates ≡ aorai_intermediate_state_1;
      ensures aorai_y ≡ \old(y);
    
    behavior buch_state_aorai_intermediate_state_1_out:
      assumes aorai_CurStates ≢ aorai_intermediate_state_0;
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
      ensures aorai_y ≡ \old(aorai_y);
    
    behavior buch_state_aorai_intermediate_state_2_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
    
    behavior buch_state_aorai_reject_in:
      assumes aorai_CurStates ≡ aorai_reject;
      ensures aorai_CurStates ≡ aorai_reject;
    
    behavior buch_state_aorai_reject_out:
      assumes aorai_CurStates ≢ aorai_reject;
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_out:
      ensures aorai_CurStates ≢ main_0;
 */
extern void g_pre_func(int y);

/*@ requires
      aorai_CurStates ≡ OK ∨
      aorai_CurStates ≡ aorai_intermediate_state_1;
    requires
      aorai_CurStates ≡ aorai_intermediate_state_1 ⇒
      aorai_y ≡ 2 ∨ aorai_y ≢ 2;
    ensures aorai_CurOpStatus ≡ aorai_Terminated;
    ensures aorai_CurOperation ≡ op_g;
    assigns aorai_CurOpStatus, aorai_CurOperation, aorai_CurStates;
    
    behavior buch_state_OK_in:
      assumes
        (aorai_CurStates ≡ aorai_intermediate_state_1 ∧ aorai_y ≡ 2) ∨
        aorai_CurStates ≡ OK;
      ensures aorai_CurStates ≡ OK;
    
    behavior buch_state_OK_out:
      assumes
        (aorai_CurStates ≢ aorai_intermediate_state_1 ∨ ¬(aorai_y ≡ 2)) ∧
        aorai_CurStates ≢ OK;
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state;
    
    behavior buch_state_aorai_intermediate_state_0_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
    
    behavior buch_state_aorai_intermediate_state_2_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
    
    behavior buch_state_aorai_reject_in:
      assumes
        aorai_CurStates ≡ aorai_reject ∨
        (aorai_CurStates ≡ aorai_intermediate_state_1 ∧ aorai_y ≢ 2);
      ensures aorai_CurStates ≡ aorai_reject;
    
    behavior buch_state_aorai_reject_out:
      assumes
        aorai_CurStates ≢ aorai_reject ∧
        (aorai_CurStates ≢ aorai_intermediate_state_1 ∨ ¬(aorai_y ≢ 2));
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_out:
      ensures aorai_CurStates ≢ main_0;
 */
extern void g_post_func(int res);

/*@ requires
      aorai_CurStates ≡ OK ∨
      aorai_CurStates ≡ aorai_intermediate_state_0;
    requires
      aorai_CurStates ≡ aorai_reject ∨ aorai_CurStates ≢ aorai_reject;
    requires
      aorai_CurStates ≡ aorai_intermediate_state_0 ∨
      aorai_CurStates ≢ aorai_intermediate_state_0;
    requires aorai_CurStates ≡ OK ∨ aorai_CurStates ≢ OK;
    ensures aorai_CurStates ≡ OK;
    
    behavior Buchi_behavior_in_2:
      assumes aorai_CurStates ≡ aorai_reject;
      ensures aorai_CurStates ≡ aorai_reject;
    
    behavior Buchi_behavior_in_1:
      assumes aorai_CurStates ≡ aorai_intermediate_state_0;
      ensures aorai_CurStates ≡ OK ∨ aorai_CurStates ≡ aorai_reject;
      ensures
        \at(aorai_CurStates ≡ aorai_intermediate_state_0,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒ aorai_y ≡ \at(y,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ aorai_intermediate_state_0,Pre) ∧
        aorai_CurStates ≡ OK ⇒ aorai_y ≡ \at(y,Pre)+0;
    
    behavior Buchi_behavior_in_0:
      assumes aorai_CurStates ≡ OK;
      ensures aorai_CurStates ≡ OK;
 */
int g(int y)
{
  g_pre_func(y);
  g_post_func(y);
  return y;
}

/*@ ensures aorai_CurOpStatus ≡ aorai_Called;
    ensures aorai_CurOperation ≡ op_main;
    assigns aorai_CurOpStatus, aorai_CurOperation, aorai_CurStates;
    
    behavior buch_state_OK_out:
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state;
    
    behavior buch_state_aorai_intermediate_state_0_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
    
    behavior buch_state_aorai_intermediate_state_2_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
    
    behavior buch_state_aorai_reject_out:
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_in:
      assumes aorai_CurStates ≡ init;
      ensures aorai_CurStates ≡ main_0;
    
    behavior buch_state_main_0_out:
      assumes aorai_CurStates ≢ init;
      ensures aorai_CurStates ≢ main_0;
 */
extern void main_pre_func(void);

/*@ requires aorai_CurStates ≡ OK;
    ensures aorai_CurOpStatus ≡ aorai_Terminated;
    ensures aorai_CurOperation ≡ op_main;
    assigns aorai_CurOpStatus, aorai_CurOperation, aorai_CurStates;
    
    behavior buch_state_OK_in:
      assumes aorai_CurStates ≡ OK;
      ensures aorai_CurStates ≡ OK;
    
    behavior buch_state_OK_out:
      assumes aorai_CurStates ≢ OK;
      ensures aorai_CurStates ≢ OK;
    
    behavior buch_state_aorai_intermediate_state_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state;
    
    behavior buch_state_aorai_intermediate_state_0_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_0;
    
    behavior buch_state_aorai_intermediate_state_1_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_1;
    
    behavior buch_state_aorai_intermediate_state_2_out:
      ensures aorai_CurStates ≢ aorai_intermediate_state_2;
    
    behavior buch_state_aorai_reject_in:
      assumes aorai_CurStates ≡ aorai_reject;
      ensures aorai_CurStates ≡ aorai_reject;
    
    behavior buch_state_aorai_reject_out:
      assumes aorai_CurStates ≢ aorai_reject;
      ensures aorai_CurStates ≢ aorai_reject;
    
    behavior buch_state_init_out:
      ensures aorai_CurStates ≢ init;
    
    behavior buch_state_main_0_out:
      ensures aorai_CurStates ≢ main_0;
 */
extern void main_post_func(int res);

/*@ requires aorai_CurStates ≡ init;
    ensures aorai_CurStates ≡ OK;
    
    behavior Buchi_property_behavior:
      ensures aorai_CurStates ≡ OK ∨ aorai_CurStates ≡ aorai_reject;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x_0 ≡ \at(1,Pre)+0 ∨ aorai_x_0 ≡ \at(aorai_x_0,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_y ≡ \at(2,Pre)+0 ∨ aorai_y ≡ \at(aorai_y,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧
        aorai_CurStates ≡ aorai_reject ⇒
        aorai_x ≡ \at(1,Pre)+0 ∨ aorai_x ≡ \at(aorai_x,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧ aorai_CurStates ≡ OK ⇒
        aorai_x_0 ≡ \at(1,Pre)+0 ∨ aorai_x_0 ≡ \at(aorai_x_0,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧ aorai_CurStates ≡ OK ⇒
        aorai_y ≡ \at(2,Pre)+0 ∨ aorai_y ≡ \at(aorai_y,Pre)+0;
      ensures
        \at(aorai_CurStates ≡ init,Pre) ∧ aorai_CurStates ≡ OK ⇒
        aorai_x ≡ \at(1,Pre)+0 ∨ aorai_x ≡ \at(aorai_x,Pre)+0;
 */
int main(void)
{
  int __retres;
  main_pre_func();
  f(1);
  g(2);
  __retres = 0;
  main_post_func(__retres);
  return __retres;
}


