From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM
	autolearn=ham autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,b49755ab898bcffd
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII
Path: 
 g2news2.google.com!postnews.google.com!v37g2000vbv.googlegroups.com!not-for-mail
From: Phil Thornley <phil.jpthornley@googlemail.com>
Newsgroups: comp.lang.ada
Subject: Re: SPARK again : for-loop vs single loop - a strange case
Date: Fri, 28 May 2010 01:14:56 -0700 (PDT)
Organization: http://groups.google.com
Message-ID: 
 <2b6ae662-77e2-4d1a-a2b2-3df54f8ab98e@v37g2000vbv.googlegroups.com>
References: <op.vddp3fvvxmjfy8@garhos>
NNTP-Posting-Host: 80.177.171.182
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Trace: posting.google.com 1275034496 3290 127.0.0.1 (28 May 2010 08:14:56
 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Fri, 28 May 2010 08:14:56 +0000 (UTC)
Complaints-To: groups-abuse@google.com
Injection-Info: v37g2000vbv.googlegroups.com; posting-host=80.177.171.182;
	posting-account=Fz1-yAoAAACc1SDCr-Py2qBj8xQ-qC2q
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64;
	Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR
	3.0.30729; Media Center PC 6.0),gzip(gfe)
Xref: g2news2.google.com comp.lang.ada:12109
Date: 2010-05-28T01:14:56-07:00
List-Id: <comp.lang.ada>

On 27 May, 20:36, Yannick Duch=EAne (Hibou57) <yannick_duch...@yahoo.fr>
wrote:
[...]
> There was a Check clause in the for-loop, which was looking like this:
>
> =A0 =A0 for L in T range 1 .. N loop
> =A0 =A0 =A0 =A0...
> =A0 =A0 =A0 =A0--# assert ...;
> =A0 =A0 =A0 =A0...
> =A0 =A0 =A0 =A0--# check (2 ** (T'Pos (L) + 1)) =3D ((2 ** T'Pos (L)) * 2=
);
> =A0 =A0 =A0 =A0...
> =A0 =A0 end loop;
>
> This Check clause was proved by the Simplifier without any trouble.
>
> I then switch to a class loop, looking like this:
>
> =A0 =A0 L :=3D 1;
>
> =A0 =A0 loop
> =A0 =A0 =A0 =A0...
> =A0 =A0 =A0 =A0--# assert ...;
> =A0 =A0 =A0 =A0...
> =A0 =A0 =A0 =A0--# check (2 ** (T'Pos (L) + 1)) =3D ((2 ** T'Pos (L)) * 2=
);
> =A0 =A0 =A0 =A0exit when L =3D Length;
> =A0 =A0 =A0 =A0L :=3D L + 1;
> =A0 =A0 =A0 =A0...
> =A0 =A0 end loop;
>
> Then, the Simplifier was not able anymore to prove this Check. I don't =
=A0
> understand, as this Check should only depends on a basic rule, a rule by =
=A0
> definition. So why the same rule is not applied when I use a classic loop=
 =A0
> instead of a for-loop ?
>
> Does SPARK changes its strategy depending on the structure of the =A0
> surrounding source so that it may or may not found a match to a rule =A0
> depending on this context ?

It is difficult to be specific about non-SPARKable code*, but one
difference at the check will be that the upper bound on L has been
lost.

You can get it back by adding L <=3D Length to the assertion.  [You
might also need to change the test to
exit when L >=3D Length;]

It is put in there aotomatically for a 'for' loop but not for a simple
loop.

Cheers,

Phil

* If the code is too big to put in a message then you can send it by
email to the address on the proof tutorials and I'll be happy to have
a look at it.