Cubicle BRAB in Why3 index
module AbstractQueue use import fol.FOL use import set.Fset as S use import reachability.Reachability type f = t type t model { ghost mutable formula: f; mutable elts: S.set f } val create () : t ensures { result.formula = ffalse /\ result.elts = S.empty } val push (f: f) (q: t) : unit writes {q} ensures { q.formula = f ++ (old q.formula) /\ q.elts = S.add f (old q.elts) } exception Empty val is_empty (q: t) : bool reads {q} ensures { result = True <-> (S.is_empty q.elts /\ q.formula = ffalse)} val pop (q: t) : f writes {q} ensures { not (S.is_empty (old q.elts)) /\ result = S.choose (old q.elts) /\ q.elts = S.remove result (old q.elts) /\ valid (result => (old q.formula)) /\ q.formula = (~ result) & (old q.formula) } raises { Empty -> S.is_empty q.elts /\ q.formula = ffalse /\ S.is_empty (old q.elts) /\ old q.formula = ffalse } val clear (q: t) : unit writes {q} ensures { q.formula = ffalse /\ q.elts = S.empty } val copy (q: t) : t ensures { result.formula = q.formula /\ result.elts = q.elts } end
Generated by why3doc 0.82+git