sl-sh | Simple Lisp Shell | Interpreter library

First of all, it would be much easier for us to answer if you give the exact code on which you've tried to launch e-acsl, including its annotations. Putting these apart, without enclosing them properly in comments only means that it's more complicated to reproduce the issue, and that we can't be sure that we are reproducing exactly your setup.

That said, here are the issues that I've spotted by looking at the annotation above (without launching frama-c on it for the reasons previously stated).

1. Indeed, you cannot call a C function into an ACSL annotation. It is possible to define logic functions and predicates in ACSL, though, that you can then use in annotations (after having defined them of course). This is described in the ACSL manual, section 2.6, and ACSL by Example contains many examples of them.

2. In ACSL, as in C, equality is denoted by ==, not =.

3. It might be a good idea to split your ensures into many clauses instead of having a single clause which is a conjunction: it would make it easier to find which part of the post-condition is not validated.

4. Similarly, unless you want to complete the contract, the behavior A: does not serve any real purpose.

5. On a stylistic side, @ is only mandatory to introduce an annotation (with /*@ ... */). You do not need to put one on each line.