Well, actually afaict the antecedent is insufficient because it does not only depend on the type of write-op performed (copy in this case) but we'd also need to define the set of read-ops allowed by the algorithm (just > in this case).
Oops, same issue in my cbmc version. 
Fixed: http://svn.clifford.at/handicraft/2018/cbmc/bsort.c …
Proving that what I do in check?b() is sufficient to prove that it is a permutation, given that elements of data[] are only copied, is left as an exercise for the reader. 
(Spoiler: It's probably not. :)
-
-
This Tweet is unavailable.
-
- Show replies
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.