How verification of Shell sorting in ACSL Frama-C?

Question

There is a software implementation of Shell sorting in C, and I also annotated it for verification in Frama-C. It is not possible to correctly compose invariants and prove the correctness of the program. Please help if you can ...

/*@ predicate Sorted{L}(int *a, integer l, integer h) =
  @   \forall integer i,j; l <= i <= j < h ==> a[i] <= a[j] ;
  @*/

/*@ requires \valid_range(arr,0,n-1);
  @ ensures Sorted(arr,0,n-1);
  @*/
void shell(int *arr, int n) {
int i, j, tmp, gap;
/*@ loop invariant 0 <= i < n;
  @ loop invariant Sorted(arr,0,i);
  @*/

for (gap = n / 2; gap > 0; gap /= 2) {

/*@ loop invariant 0 <= i < n;
  @ loop invariant Sorted(arr,0,i);
  @*/
    for (i = gap; i < n; ++i) {
        tmp = arr[i];
/*@ loop invariant 0 <= j <= i < n;
  @ loop invariant j == i ==> Sorted(arr,0,i);
  @ loop invariant j < i ==> Sorted(arr,0,i+1);
  @ loop invariant \forall integer k; j <= k < i ==> arr[k] > gap;
  @ loop invariant \forall integer k; j <= k <= i ==> arr[k-gap] > tmp;
  @ loop invariant j >= gap >0 && arr[j-gap] > tmp;
  @ loop variant j;
  @*/
       for (j = i; j >= gap && arr[j - gap] > tmp; j -= gap) {
            arr[j] = arr[j - gap];
        }
        arr[j] = tmp;
    }
}
}

It would help if you could explain what is missing, i.e. write in English what constraints you wish to express that are not expressed yet in Frama-C. — Kuba hasn't forgotten Monica, Oct 26 '19 at 19:44
It is necessary to construct the invariants of cycles for this algorithm — Gersa, Oct 27 '19 at 08:25
@Gersa, I think that what Kuba Ober is trying to say is that before writing ACSL formulas, you need to be sure that you can express the invariants clearly in natural language (English or other). Right now, there are too many issues there for us to provide an answer adapted too SO format. Notably, for shell sort you need to refine the `sorted` predicate to a notion of `k-sorted` denoting that `arr[i] <= arr[i+k]`. Similarly, it does not make sense to compare `gap` as an element of the array (in `arr[k] > gap`), etc. As an aside, don't forget that you must provide `loop assigns` for each loop — Virgile, Oct 27 '19 at 09:54

How verification of Shell sorting in ACSL Frama-C?

0 Answers0