Verification issue using the Jessie plug-in and Frama-C -

i'm new frama-c , want learn acsl syntax properly. have dummy example , jessie plug-in cannot verify line nr 9 , 12. missing something? function verified (equal) check if 2 arrays (a , b) have same values or not @ each index:

/*@      requires \valid_range(a,0,n-1);      requires \valid_range(b,0,n-1);      requires n >= 0;      requires >= 0 && <= n;      assigns i;      behavior all_equal:          assumes == n;          ensures \result == 1;      behavior some_not_equal:         assumes != n;         ensures \result == 0; */ int equal(int a[], int n, int b[], int i) {   /*@      loop invariant 0 <= <= n;     loop assigns i;     loop variant n-i;   */     (i = 0; < n; i++) {     if (a[i] != b[i])       return 0;   }   return 1; } 

there couple of incorrect things here:

behavior all_equal:      assumes == n;      ensures \result == 1;  behavior some_not_equal:     assumes != n;     ensures \result == 0; 

in assumes clause, variables evaluated in pre-state of function. meaning if have 2 equal arrays of size n, , assuming i 0 (which not be, see next explanation), i == n fail except when array of size 0

another thing: seem using i variable loop control, setting 0 @ start of loop, in annotations i, in pre-state of program, between 0 , n. in conjunction said 1 of reasons why jessie isn't able prove this.

finally, main reason cannot prove because missing essential loop invariant, 1 guarantees both arrays, array indexes previous current iteration, equal:

loop invariant loop invariant \forall integer k; 0 <= k < ==> a[k] == b[k]; 

with invariant can specify behaviors better. correct solution problem be:

/*@      requires \valid_range(a,0,n-1);      requires \valid_range(b,0,n-1);      requires n >= 0;      behavior all_equal:          assumes \forall integer k; 0 <= k < n ==> a[k] == b[k];          ensures \result == 1;      behavior some_not_equal:         assumes \exists integer k; 0 <= k < n  && a[k] != b[k];         ensures \result == 0; */ int equal(int a[], int n, int b[]) {   int = 0;   /*@      loop invariant 0 <= <= n;     loop invariant \forall integer k; 0 <= k < ==> a[k] == b[k];     loop assigns i;     loop variant n-i;   */     (i = 0; < n; i++) {     if (a[i] != b[i])       return 0;   }   return 1; }