public static VCExpr Block(Block b, VCExpr N, VCContext ctxt) //modifies ctxt.*; { Contract.Requires(b != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); VCExpr res = N; for (int i = b.Cmds.Count; --i >= 0;) { res = Cmd(b, cce.NonNull(b.Cmds[i]), res, ctxt); } int id = b.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = b; } try { cce.BeginExpose(ctxt); return(res); } finally { cce.EndExpose(); } }
public static VCExpr Block(Block b, VCExpr N, VCContext ctxt) //modifies ctxt.*; { Contract.Requires(b != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); VCExpr res = N; for (int i = b.Cmds.Count; --i >= 0; ) { res = Cmd(b, cce.NonNull( b.Cmds[i]), res, ctxt); } int id = b.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = b; } try { cce.BeginExpose(ctxt); if (ctxt.Label2absy == null) { return res; } else { return gen.Implies(gen.LabelPos(cce.NonNull(id.ToString()), VCExpressionGenerator.True), res); } } finally { cce.EndExpose(); } }
private static VCExpr MaybeWrapWithOptimization(VCContext ctxt, VCExpressionGenerator gen, QKeyValue attrs, VCExpr expr) { var min = QKeyValue.FindExprAttribute(attrs, "minimize"); if (min != null) { expr = gen.Function(VCExpressionGenerator.MinimizeOp, ctxt.Ctxt.BoogieExprTranslator.Translate(min), expr); } var max = QKeyValue.FindExprAttribute(attrs, "maximize"); if (max != null) { expr = gen.Function(VCExpressionGenerator.MaximizeOp, ctxt.Ctxt.BoogieExprTranslator.Translate(max), expr); } return(expr); }
public static VCExpr RegExpr(RE r, VCExpr N, VCContext ctxt) { Contract.Requires(r != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); if (r is AtomicRE) { AtomicRE ar = (AtomicRE)r; return(Block(ar.b, N, ctxt)); } else if (r is Sequential) { Sequential s = (Sequential)r; return(RegExpr(s.first, RegExpr(s.second, N, ctxt), ctxt)); } else if (r is Choice) { Choice ch = (Choice)r; VCExpr res; if (ch.rs == null || ch.rs.Count == 0) { res = N; } else { VCExpr currentWLP = RegExpr(cce.NonNull(ch.rs[0]), N, ctxt); for (int i = 1, n = ch.rs.Count; i < n; i++) { currentWLP = ctxt.Ctxt.ExprGen.And(currentWLP, RegExpr(cce.NonNull(ch.rs[i]), N, ctxt)); } res = currentWLP; } return(res); } else { Contract.Assert(false); throw new cce.UnreachableException(); // unexpected RE subtype } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; var isFullyVerified = false; if (ac.VerifiedUnder != null) { var litExpr = ac.VerifiedUnder as LiteralExpr; isFullyVerified = litExpr != null && litExpr.IsTrue; } if (!isFullyVerified) { ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); VCExpr VU = null; if (!isFullyVerified) { if (ac.VerifiedUnder != null) { VU = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.VerifiedUnder); } ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr R = null; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { R = gen.Implies(C, N); } else { var subsumption = Subsumption(ac); if (subsumption == CommandLineOptions.SubsumptionOption.Always || (subsumption == CommandLineOptions.SubsumptionOption.NotForQuantifiers && !(C is VCExprQuantifier))) { N = gen.ImpliesSimp(C, N, false); } if (isFullyVerified) { return(N); } else if (VU != null) { C = gen.OrSimp(VU, C); } int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { R = gen.AndSimp(gen.Implies(assertFailure, C), N); } else { R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N); } } } return(R); } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return(gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } } } return(gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N)); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
VCExpr LetVC(Block block, Dictionary<int, Absy> label2absy, Hashtable/*<Block, VCExprVar!>*/ blockVariables, List<VCExprLetBinding> bindings, ProverContext proverCtxt, out int assertionCount) { Contract.Requires(label2absy != null); Contract.Requires(blockVariables != null); Contract.Requires(proverCtxt != null); Contract.Requires(cce.NonNullElements(bindings)); Contract.Ensures(Contract.Result<VCExpr>() != null); assertionCount = 0; VCExpressionGenerator gen = proverCtxt.ExprGen; Contract.Assert(gen != null); VCExprVar v = (VCExprVar)blockVariables[block]; if (v == null) { /* * For block A (= block), generate: * LET_binding A_correct = wp(A_body, (/\ S \in Successors(A) :: S_correct)) * with the side effect of adding the let bindings to "bindings" for any * successor not yet visited. */ VCExpr SuccCorrect; GotoCmd gotocmd = block.TransferCmd as GotoCmd; if (gotocmd == null) { if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { SuccCorrect = VCExpressionGenerator.False; } else { SuccCorrect = VCExpressionGenerator.True; } } else { Contract.Assert( gotocmd.labelTargets != null); List<VCExpr> SuccCorrectVars = new List<VCExpr>(gotocmd.labelTargets.Count); foreach (Block successor in gotocmd.labelTargets) { Contract.Assert(successor != null); int ac; VCExpr s = LetVC(successor, label2absy, blockVariables, bindings, proverCtxt, out ac); assertionCount += ac; SuccCorrectVars.Add(s); } SuccCorrect = gen.NAry(VCExpressionGenerator.AndOp, SuccCorrectVars); } VCContext context = new VCContext(label2absy, proverCtxt); // m_Context = context; VCExpr vc = Wlp.Block(block, SuccCorrect, context); assertionCount += context.AssertionCount; v = gen.Variable(block.Label + "_correct", Microsoft.Boogie.Type.Bool); bindings.Add(gen.LetBinding(v, vc)); blockVariables.Add(block, v); } return v; }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr P_Cmd(Block b, HashSet <string> constantsAssumed, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return(gen.Implies(C, N)); } else { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } switch (Subsumption(ac)) { case CommandLineOptions.SubsumptionOption.Never: break; case CommandLineOptions.SubsumptionOption.Always: N = gen.Implies(C, N); break; case CommandLineOptions.SubsumptionOption.NotForQuantifiers: if (!(C is VCExprQuantifier)) { N = gen.Implies(C, N); } break; default: Contract.Assert(false); throw new cce.UnreachableException(); // unexpected case } // (MSchaef) Hack: This line might be useless, but at least it is not harmful // need to test it if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return(gen.Implies(C, N)); } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return(gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N)); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { return(gen.AndSimp(gen.Implies(assertFailure, C), N)); } else { return(gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N)); } } } } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { Contract.Assert(false); throw new System.Exception(string.Format("VC Generation in ICE-learning does not handle stratified inlining")); var pname = QKeyValue.FindStringAttribute(ac.Attributes, "candidate"); if (pname != null) { return(gen.ImpliesSimp(gen.LabelPos("candidate_" + pname.ToString(), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return(gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } } } //return gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N); else { if (constantsAssumed == null) { return(gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N)); } // check if the assume command contains any of the constantsAssumed (corresponding to existential function calls)? var funcsUsed = FunctionCollector.Collect(ac.Expr); bool hasAnyConstantAssumed = false; foreach (var tup in funcsUsed) { var constantFunc = tup.Item1; if (constantsAssumed.Contains(constantFunc.Name)) { hasAnyConstantAssumed = true; break; } } if (hasAnyConstantAssumed) { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } //ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return(gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } else { return(gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N)); /*VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); * Contract.Assert(controlFlowFunctionAppl != null); * VCExpr assumeFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); * if (ctxt.Label2absy == null) * { * throw new System.Exception(string.Format("Dont know how to handle labels for the assume cmd")); * //return gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), gen.Implies(assumeFailure, ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr))), N); * } * else * { * return gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), gen.Implies(assumeFailure, ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr))), N); * } */ } } else { return(gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N)); } } } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return(gen.Implies(C, N)); } else { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } switch (Subsumption(ac)) { case CommandLineOptions.SubsumptionOption.Never: break; case CommandLineOptions.SubsumptionOption.Always: N = gen.Implies(C, N); break; case CommandLineOptions.SubsumptionOption.NotForQuantifiers: if (!(C is VCExprQuantifier)) { N = gen.Implies(C, N); } break; default: Contract.Assert(false); throw new cce.UnreachableException(); // unexpected case } // (MSchaef) Hack: This line might be useless, but at least it is not harmful // need to test it if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return(gen.Implies(C, N)); } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return(gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N)); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { return(gen.AndSimp(gen.Implies(assertFailure, C), N)); } else { return(gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N)); } } } } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { var pname = QKeyValue.FindStringAttribute(ac.Attributes, "candidate"); if (pname != null) { return(gen.ImpliesSimp(gen.LabelPos("candidate_" + pname.ToString(), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return(gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } } } return(gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N)); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
public static VCExpr P_Block(Block b, HashSet <string> constantsAssumed, VCExpr N, VCContext ctxt) //modifies ctxt.*; { Contract.Requires(b != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); VCExpr res = N; for (int i = b.Cmds.Count; --i >= 0;) { res = P_Cmd(b, constantsAssumed, cce.NonNull(b.Cmds[i]), res, ctxt); } int id = b.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = b; } try { cce.BeginExpose(ctxt); if (ctxt.Label2absy == null) { return(res); } else { return(gen.Implies(gen.LabelPos(cce.NonNull(id.ToString()), VCExpressionGenerator.True), res)); } } finally { cce.EndExpose(); } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> internal static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; var isFullyVerified = false; if (ac.VerifiedUnder != null) { var litExpr = ac.VerifiedUnder as LiteralExpr; isFullyVerified = litExpr != null && litExpr.IsTrue; } if (!isFullyVerified) { ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); VCExpr VU = null; if (!isFullyVerified) { if (ac.VerifiedUnder != null) { VU = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.VerifiedUnder); if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimoutDiagnosticsCount] = new Tuple<AssertCmd,TransferCmd>(ac, b.TransferCmd); VU = gen.Or(VU, gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimoutDiagnosticsCount++)))); } } else if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimoutDiagnosticsCount] = new Tuple<AssertCmd,TransferCmd>(ac, b.TransferCmd); VU = gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimoutDiagnosticsCount++))); } ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr R = null; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { R = gen.Implies(C, N); } else { var subsumption = Subsumption(ac); if (subsumption == CommandLineOptions.SubsumptionOption.Always || (subsumption == CommandLineOptions.SubsumptionOption.NotForQuantifiers && !(C is VCExprQuantifier))) { N = gen.ImpliesSimp(C, N, false); } if (isFullyVerified) { return N; } else if (VU != null) { C = gen.OrSimp(VU, C); } int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { R = gen.AndSimp(gen.Implies(assertFailure, C), N); } else { R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N); } } } return R; } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return MaybeWrapWithOptimization(ctxt, gen, ac.Attributes, gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N)); } } } var expr = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); var aid = QKeyValue.FindStringAttribute(ac.Attributes, "id"); if (aid != null) { var isTry = QKeyValue.FindBoolAttribute(ac.Attributes, "try"); var v = gen.Variable((isTry ? "try$$" : "assume$$") + aid, Microsoft.Boogie.Type.Bool); expr = gen.Function(VCExpressionGenerator.NamedAssumeOp, v, gen.ImpliesSimp(v, expr)); } var soft = QKeyValue.FindBoolAttribute(ac.Attributes, "soft"); var softWeight = QKeyValue.FindIntAttribute(ac.Attributes, "soft", 0); if ((soft || 0 < softWeight) && aid != null) { var v = gen.Variable("soft$$" + aid, Microsoft.Boogie.Type.Bool); expr = gen.Function(new VCExprSoftOp(Math.Max(softWeight, 1)), v, gen.ImpliesSimp(v, expr)); } return MaybeWrapWithOptimization(ctxt, gen, ac.Attributes, gen.ImpliesSimp(expr, N)); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return gen.Implies(C, N); } else { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } switch (Subsumption(ac)) { case CommandLineOptions.SubsumptionOption.Never: break; case CommandLineOptions.SubsumptionOption.Always: N = gen.Implies(C, N); break; case CommandLineOptions.SubsumptionOption.NotForQuantifiers: if (!(C is VCExprQuantifier)) { N = gen.Implies(C, N); } break; default: Contract.Assert(false); throw new cce.UnreachableException(); // unexpected case } // (MSchaef) Hack: This line might be useless, but at least it is not harmful // need to test it if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) return gen.Implies(C, N); ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { return gen.AndSimp(gen.Implies(assertFailure, C), N); } else { return gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N); } } } } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { var pname = QKeyValue.FindStringAttribute(ac.Attributes, "candidate"); if (pname != null) { return gen.ImpliesSimp(gen.LabelPos("candidate_" + pname.ToString(), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } } } return gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
public static VCExpr RegExpr(RE r, VCExpr N, VCContext ctxt) { Contract.Requires(r != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); if ( r is AtomicRE ) { AtomicRE ar = (AtomicRE) r; return Block(ar.b, N, ctxt); } else if ( r is Sequential ) { Sequential s = (Sequential) r; return RegExpr(s.first, RegExpr(s.second, N, ctxt), ctxt); } else if ( r is Choice ) { Choice ch = (Choice) r; VCExpr res; if (ch.rs == null || ch.rs.Count==0) { res = N; } else { VCExpr currentWLP = RegExpr(cce.NonNull(ch.rs[0]), N, ctxt); for (int i = 1, n = ch.rs.Count; i < n; i++) { currentWLP = ctxt.Ctxt.ExprGen.And(currentWLP, RegExpr(cce.NonNull(ch.rs[i]), N, ctxt)); } res = currentWLP; } return res; } else { Contract.Assert(false);throw new cce.UnreachableException(); // unexpected RE subtype } }
private static VCExpr MaybeWrapWithOptimization(VCContext ctxt, VCExpressionGenerator gen, QKeyValue attrs, VCExpr expr) { var min = QKeyValue.FindExprAttribute(attrs, "minimize"); if (min != null) { expr = gen.Function(VCExpressionGenerator.MinimizeOp, ctxt.Ctxt.BoogieExprTranslator.Translate(min), expr); } var max = QKeyValue.FindExprAttribute(attrs, "maximize"); if (max != null) { expr = gen.Function(VCExpressionGenerator.MaximizeOp, ctxt.Ctxt.BoogieExprTranslator.Translate(max), expr); } return expr; }
VCExpr LetVC(Block block, Dictionary <int, Absy> label2absy, Hashtable /*<Block, VCExprVar!>*/ blockVariables, List <VCExprLetBinding> bindings, ProverContext proverCtxt, out int assertionCount) { Contract.Requires(label2absy != null); Contract.Requires(blockVariables != null); Contract.Requires(proverCtxt != null); Contract.Requires(cce.NonNullElements(bindings)); Contract.Ensures(Contract.Result <VCExpr>() != null); assertionCount = 0; VCExpressionGenerator gen = proverCtxt.ExprGen; Contract.Assert(gen != null); VCExprVar v = (VCExprVar)blockVariables[block]; if (v == null) { /* * For block A (= block), generate: * LET_binding A_correct = wp(A_body, (/\ S \in Successors(A) :: S_correct)) * with the side effect of adding the let bindings to "bindings" for any * successor not yet visited. */ VCExpr SuccCorrect; GotoCmd gotocmd = block.TransferCmd as GotoCmd; if (gotocmd == null) { if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { SuccCorrect = VCExpressionGenerator.False; } else { SuccCorrect = VCExpressionGenerator.True; } } else { Contract.Assert(gotocmd.labelTargets != null); List <VCExpr> SuccCorrectVars = new List <VCExpr>(gotocmd.labelTargets.Count); foreach (Block successor in gotocmd.labelTargets) { Contract.Assert(successor != null); int ac; VCExpr s = LetVC(successor, label2absy, blockVariables, bindings, proverCtxt, out ac); assertionCount += ac; SuccCorrectVars.Add(s); } SuccCorrect = gen.NAry(VCExpressionGenerator.AndOp, SuccCorrectVars); } VCContext context = new VCContext(label2absy, proverCtxt); // m_Context = context; VCExpr vc = Wlp.Block(block, SuccCorrect, context); assertionCount += context.AssertionCount; v = gen.Variable(block.Label + "_correct", Microsoft.Boogie.Type.Bool); bindings.Add(gen.LetBinding(v, vc)); blockVariables.Add(block, v); } return(v); }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr P_Cmd(Block b, HashSet<string> constantsAssumed, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { return gen.Implies(C, N); } else { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } switch (Subsumption(ac)) { case CommandLineOptions.SubsumptionOption.Never: break; case CommandLineOptions.SubsumptionOption.Always: N = gen.Implies(C, N); break; case CommandLineOptions.SubsumptionOption.NotForQuantifiers: if (!(C is VCExprQuantifier)) { N = gen.Implies(C, N); } break; default: Contract.Assert(false); throw new cce.UnreachableException(); // unexpected case } // (MSchaef) Hack: This line might be useless, but at least it is not harmful // need to test it if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) return gen.Implies(C, N); ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { return gen.AndSimp(gen.Implies(assertFailure, C), N); } else { return gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N); } } } } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { Contract.Assert(false); throw new System.Exception(string.Format("VC Generation in ICE-learning does not handle stratified inlining")); var pname = QKeyValue.FindStringAttribute(ac.Attributes, "candidate"); if (pname != null) { return gen.ImpliesSimp(gen.LabelPos("candidate_" + pname.ToString(), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } } } else { if (constantsAssumed == null) return gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N); // check if the assume command contains any of the constantsAssumed (corresponding to existential function calls)? var funcsUsed = FunctionCollector.Collect(ac.Expr); bool hasAnyConstantAssumed = false; foreach (var tup in funcsUsed) { var constantFunc = tup.Item1; if (constantsAssumed.Contains(constantFunc.Name)) { hasAnyConstantAssumed = true; break; } } if (hasAnyConstantAssumed) { int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } //ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } else { /* TODO: Check if this is correct!! */ VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assumeFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { throw new System.Exception(string.Format("Dont know how to handle labels for the assume cmd")); //return gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), gen.Implies(assumeFailure, ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr))), N); } else { return gen.ImpliesSimp(gen.LabelPos(cce.NonNull(id.ToString()), gen.Implies(assumeFailure, ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr))), N); } } } else return gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N); } } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> internal static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result <VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; var isFullyVerified = false; if (ac.VerifiedUnder != null) { var litExpr = ac.VerifiedUnder as LiteralExpr; isFullyVerified = litExpr != null && litExpr.IsTrue; } if (!isFullyVerified) { ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); VCExpr VU = null; if (!isFullyVerified) { if (ac.VerifiedUnder != null) { VU = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.VerifiedUnder); if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimeoutDiagnosticsCount] = new Tuple <AssertCmd, TransferCmd>(ac, b.TransferCmd); VU = gen.Or(VU, gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimeoutDiagnosticsCount++)))); } } else if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimeoutDiagnosticsCount] = new Tuple <AssertCmd, TransferCmd>(ac, b.TransferCmd); VU = gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimeoutDiagnosticsCount++))); } ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } { var subsumption = Subsumption(ac); if (subsumption == CommandLineOptions.SubsumptionOption.Always || (subsumption == CommandLineOptions.SubsumptionOption.NotForQuantifiers && !(C is VCExprQuantifier))) { N = gen.ImpliesSimp(C, N, false); } if (isFullyVerified) { return(N); } else if (VU != null) { C = gen.OrSimp(VU, C); } int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); return(gen.AndSimp(C, N)); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); return(gen.AndSimp(gen.Implies(assertFailure, C), N)); } } } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return(MaybeWrapWithOptimization(ctxt, gen, ac.Attributes, gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N))); } } } var expr = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); var aid = QKeyValue.FindStringAttribute(ac.Attributes, "id"); if (aid != null) { var isTry = QKeyValue.FindBoolAttribute(ac.Attributes, "try"); var v = gen.Variable((isTry ? "try$$" : "assume$$") + aid, Microsoft.Boogie.Type.Bool); expr = gen.Function(VCExpressionGenerator.NamedAssumeOp, v, gen.ImpliesSimp(v, expr)); } var soft = QKeyValue.FindBoolAttribute(ac.Attributes, "soft"); var softWeight = QKeyValue.FindIntAttribute(ac.Attributes, "soft", 0); if ((soft || 0 < softWeight) && aid != null) { var v = gen.Variable("soft$$" + aid, Microsoft.Boogie.Type.Bool); expr = gen.Function(new VCExprSoftOp(Math.Max(softWeight, 1)), v, gen.ImpliesSimp(v, expr)); } return(MaybeWrapWithOptimization(ctxt, gen, ac.Attributes, gen.ImpliesSimp(expr, N))); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }
/// <summary> /// Computes the wlp for an assert or assume command "cmd". /// </summary> public static VCExpr Cmd(Block b, Cmd cmd, VCExpr N, VCContext ctxt) { Contract.Requires(cmd != null); Contract.Requires(N != null); Contract.Requires(ctxt != null); Contract.Ensures(Contract.Result<VCExpr>() != null); VCExpressionGenerator gen = ctxt.Ctxt.ExprGen; Contract.Assert(gen != null); if (cmd is AssertCmd) { AssertCmd ac = (AssertCmd)cmd; var isFullyVerified = false; if (ac.VerifiedUnder != null) { var litExpr = ac.VerifiedUnder as LiteralExpr; isFullyVerified = litExpr != null && litExpr.IsTrue; } if (!isFullyVerified) { ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr C = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr); VCExpr VU = null; if (!isFullyVerified) { if (ac.VerifiedUnder != null) { VU = ctxt.Ctxt.BoogieExprTranslator.Translate(ac.VerifiedUnder); if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimoutDiagnosticsCount] = new Tuple<AssertCmd,TransferCmd>(ac, b.TransferCmd); VU = gen.Or(VU, gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimoutDiagnosticsCount++)))); } } else if (CommandLineOptions.Clo.RunDiagnosticsOnTimeout) { ctxt.Ctxt.TimeoutDiagnosticIDToAssertion[ctxt.Ctxt.TimoutDiagnosticsCount] = new Tuple<AssertCmd,TransferCmd>(ac, b.TransferCmd); VU = gen.Function(VCExpressionGenerator.TimeoutDiagnosticsOp, gen.Integer(BigNum.FromInt(ctxt.Ctxt.TimoutDiagnosticsCount++))); } ctxt.Ctxt.BoogieExprTranslator.isPositiveContext = !ctxt.Ctxt.BoogieExprTranslator.isPositiveContext; } VCExpr R = null; if (CommandLineOptions.Clo.vcVariety == CommandLineOptions.VCVariety.Doomed) { R = gen.Implies(C, N); } else { var subsumption = Subsumption(ac); if (subsumption == CommandLineOptions.SubsumptionOption.Always || (subsumption == CommandLineOptions.SubsumptionOption.NotForQuantifiers && !(C is VCExprQuantifier))) { N = gen.ImpliesSimp(C, N, false); } if (isFullyVerified) { return N; } else if (VU != null) { C = gen.OrSimp(VU, C); } int id = ac.UniqueId; if (ctxt.Label2absy != null) { ctxt.Label2absy[id] = ac; } ctxt.AssertionCount++; if (ctxt.ControlFlowVariableExpr == null) { Contract.Assert(ctxt.Label2absy != null); R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), C), N); } else { VCExpr controlFlowFunctionAppl = gen.ControlFlowFunctionApplication(ctxt.ControlFlowVariableExpr, gen.Integer(BigNum.FromInt(b.UniqueId))); Contract.Assert(controlFlowFunctionAppl != null); VCExpr assertFailure = gen.Eq(controlFlowFunctionAppl, gen.Integer(BigNum.FromInt(-ac.UniqueId))); if (ctxt.Label2absy == null) { R = gen.AndSimp(gen.Implies(assertFailure, C), N); } else { R = gen.AndSimp(gen.LabelNeg(cce.NonNull(id.ToString()), gen.Implies(assertFailure, C)), N); } } } return R; } else if (cmd is AssumeCmd) { AssumeCmd ac = (AssumeCmd)cmd; if (CommandLineOptions.Clo.StratifiedInlining > 0) { // Label the assume if it is a procedure call NAryExpr naryExpr = ac.Expr as NAryExpr; if (naryExpr != null) { if (naryExpr.Fun is FunctionCall) { int id = ac.UniqueId; ctxt.Label2absy[id] = ac; return gen.ImpliesSimp(gen.LabelPos(cce.NonNull("si_fcall_" + id.ToString()), ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr)), N); } } } return gen.ImpliesSimp(ctxt.Ctxt.BoogieExprTranslator.Translate(ac.Expr), N); } else { Console.WriteLine(cmd.ToString()); Contract.Assert(false); throw new cce.UnreachableException(); // unexpected command } }