• Bug discovered: pure functions are incorrectly translated into Boogie.
• Problem: access to local variables of other threads is in VCC not possible on the specification level. Solution: pack locals into structures which the current thread possesses.
• Possible unsoundness:
  _(requires \wrapped(&inst))
_(requires \wrapped(&local_sense))
  leads to succeeding
  _(assert \false).
  Solution: do not use shared file-scope variables.
• Apparently, \me is not a \thread, so there is no way to distinguish the current thread from the other ones. Bug reported.
• File-scope statically default-initialized variables are not supported. Not really disturbing, but bug reported.
• We can't prove that pc[\me] remains unchanged between the actions of the verified thread.
  Trying out: expose all local state into a shared structure LocalData and maintain a map of such local structures.
  Subproblem: Complicated assignments like p_inst->ld[\me].local_sense^=1 can't be parsed. Solution to the subproblem: use temporary variables.
  Subproblem: substructures can't be owned. Trying out: declare pointers to substructures.
• Problem solved: Developers have provided a bunch of undocumented features that allow expressing ownership over the local state. New problem: expressing nontrivial features of the shared data structure that require recursive predicates fails.
• Solution to the previous problem: recursive predicate abandoned, since VCC provides no checking support for them and using Boogie-HOL is "probably not going to work". Instead encode "the number of threads before the decrement = count" as "exactly the threads with thread ID < count are before the decrement" and swap the thread IDs dynamically. Requires maintaining a bijection.
• Problem: annotations are huge. Simplification of the bijection as suggested by the developpers does not work. That's why: the buggy construct "depends" was used.
  Solution: use "approves" instead of "depends". Now the annotations of the simplest barrier core are simpler.
• The barrier gets verified in 4.4 s. Suggestions of the developpers are partially implemented. Code was slightly simplified and verifies now in 3.752857 s.
• Then, we made the code got textually smaller and easier to understand. The time to verify is 4.73 s.
• Finally, it turned out that we don't need the abstract location WaitPL. Got rid of it. The time to verify is now 2.92 s on an Intel 2.4 GHz Intel® CPU with 8 GB RAM.
• The VCC team has changed bool to \bool, but also improved threorem proving. As a result, the check myId < s->count is no more needed. The time to verify is now 3.427 s on an Intel® Core™ 2 DUO L7500 CPU clocked at 1.6 GHz with 1.5 GB RAM clocked at 533 MHz.