Strictly speaking, the following lemma needs
to assume that 'l' is "well-aligned":
prfun
bytes_v_to_vector_v
{a:vt0p}{l:agz}{n:pos}
(pf: bytes_v (l, n * sizeof(a))):<> vector_v (a, l, n)
Also, vector_v(a, l, n) should be changed to vector_v(a?, l, n).
Program verification is really just a form conditional verification
of some sort. Implicit assumptions are made all the time in practice.
--
You received this message because you are subscribed to the Google Groups
"ats-lang-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/ats-lang-users.
To view this discussion on the web visit
https://groups.google.com/d/msgid/ats-lang-users/0c3eaf61-3408-47b6-85f1-ed889c5eacc3%40googlegroups.com.
