diff --git a/src/file_mid.c b/src/file_mid.c
index c013e037..e01e3846 100644
--- a/src/file_mid.c
+++ b/src/file_mid.c
@@ -33,6 +33,7 @@
 #include "common.h"
 #include "log.h"
 
+/*@ requires \valid(file_stat); */
 static void register_header_check_mid(file_stat_t *file_stat);
 
 const file_hint_t file_hint_mid= {
@@ -55,6 +56,18 @@ struct midi_header
   int16_t time_division;
 } __attribute__ ((gcc_struct, __packed__));
 
+/*@
+  @ requires valid_file_recovery(file_recovery);
+  @ requires \valid(file_recovery->handle);
+  @ requires file_recovery->file_check == &file_check_midi;
+  @ requires separation: \separated(file_recovery, file_recovery->handle, &errno, &Frama_C_entropy_source);
+  @ assigns  errno;
+  @ assigns  file_recovery->calculated_file_size;
+  @ assigns  file_recovery->file_size;
+  @ assigns  *file_recovery->handle;
+  @ assigns  file_recovery->time;
+  @ assigns  Frama_C_entropy_source;
+  @*/
 static void file_check_midi(file_recovery_t *file_recovery)
 {
   const uint64_t fs_org=file_recovery->file_size;
@@ -67,6 +80,10 @@ static void file_check_midi(file_recovery_t *file_recovery)
       fread(&hdr, sizeof(hdr), 1, file_recovery->handle) != 1)
     return ;
   tracks=be16(hdr.tracks);
+  /*@
+    @ loop assigns i, *file_recovery->handle, fs;
+    @ loop assigns errno, Frama_C_entropy_source;
+    @*/
   for(i=0; i<tracks; i++)
   {
     struct midi_header track;
@@ -84,12 +101,25 @@ static void file_check_midi(file_recovery_t *file_recovery)
   file_recovery->file_size=fs;
 }
 
+/*@
+  @ requires buffer_size >= 2 && (buffer_size&1)==0;
+  @ requires \valid(file_recovery);
+  @ requires \valid_read(buffer + ( 0 .. buffer_size-1));
+  @ requires file_recovery->data_check == &data_check_midi;
+  @ requires separation: \separated(buffer+(..), file_recovery);
+  @ ensures \result == DC_CONTINUE || \result == DC_STOP;
+  @ assigns file_recovery->calculated_file_size;
+  @*/
 static data_check_t data_check_midi(const unsigned char *buffer, const unsigned int buffer_size, file_recovery_t *file_recovery)
 {
+  /*@
+    @ loop assigns file_recovery->calculated_file_size;
+    @*/
   while(file_recovery->calculated_file_size + buffer_size/2  >= file_recovery->file_size &&
       file_recovery->calculated_file_size + 8 < file_recovery->file_size + buffer_size/2)
   {
-    const unsigned int i=file_recovery->calculated_file_size - file_recovery->file_size + buffer_size/2;
+    const unsigned int i=file_recovery->calculated_file_size + buffer_size/2 - file_recovery->file_size;
+    /*@ assert 0 <= i < buffer_size - 8; */
     const struct midi_header *hdr=(const struct midi_header*)&buffer[i];
     const uint64_t len=be32(hdr->len);
 #ifdef DEBUG_MIDI
@@ -102,6 +132,17 @@ static data_check_t data_check_midi(const unsigned char *buffer, const unsigned
   return DC_CONTINUE;
 }
 
+/*@
+  @ requires buffer_size >= sizeof(struct midi_header);
+  @ requires \valid_read(buffer+(0..buffer_size-1));
+  @ requires valid_file_recovery(file_recovery);
+  @ requires \valid(file_recovery_new);
+  @ requires file_recovery_new->blocksize > 0;
+  @ requires separation: \separated(&file_hint_mid, buffer+(..), file_recovery, file_recovery_new);
+  @ assigns  *file_recovery_new;
+  @ ensures \result == 0 || \result == 1;
+  @ ensures  \result!=0 ==> valid_file_recovery(file_recovery_new);
+  @*/
 static int header_check_mid(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
 {
   const struct midi_header *hdr=(const struct midi_header *)buffer;