From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
	autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,dbbbb21ed7f581b
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII-7-bit
Path: 
 g2news1.google.com!news3.google.com!proxad.net!feeder1-2.proxad.net!194.25.134.126.MISMATCH!newsfeed01.sul.t-online.de!t-online.de!newsfeed.arcor.de!newsspool1.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Date: Tue, 08 Dec 2009 11:33:25 +0100
From: Georg Bauhaus <rm.dash-bauhaus@futureapps.de>
User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812)
MIME-Version: 1.0
Newsgroups: comp.lang.ada
Subject: Re: Operation can be dispatching in only one type
References: 
 <025105f2-5571-400e-a66f-ef1c3dc9ef32@g27g2000yqn.googlegroups.com>
 <Pine.LNX.4.64.0911230311040.30588@medsec1.medien.uni-weimar.de>
 <wcc8wdn697e.fsf@shell01.TheWorld.com>
 <4b150869$0$6732$9b4e6d93@newsspool2.arcor-online.net>
 <18vlg095bomhd.8bp1o9yysctg$.dlg@40tude.net>
 <4b152ffe$0$7615$9b4e6d93@newsspool1.arcor-online.net>
 <19nhib6rmun1x$.13vgcbhlh0og9$.dlg@40tude.net>
 <4b1557d0$0$7623$9b4e6d93@newsspool1.arcor-online.net>
 <wof0ewwkyzy0$.13398rnn8cmje$.dlg@40tude.net>
 <4b15bf2b$0$7623$9b4e6d93@newsspool1.arcor-online.net>
 <1jcbtmi5rztyp$.norvlhez9i9$.dlg@40tude.net> <hf7icf$ffm$1@munin.nbi.dk>
 <4b179ffb$0$6591$9b4e6d93@newsspool3.arcor-online.net>
 <hf9gcj$oog$1@munin.nbi.dk> <qchmzfxola9n$.1owojhwd91cbc.dlg@40tude.net>
 <hfchg1$mtd$1@munin.nbi.dk> <1gcigitaii0u0.1psu2vj52e66g$.dlg@40tude.net>
 <hfk624$ej8$1@munin.nbi.dk> <1wv3of2u7rbx8.4a6yeffk4uf3.dlg@40tude.net>
 <4b1e253f$0$6725$9b4e6d93@newsspool2.arcor-online.net>
 <qfb4wvp9d01t$.1hennmwa19x4i.dlg@40tude.net>
In-Reply-To: <qfb4wvp9d01t$.1hennmwa19x4i.dlg@40tude.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-ID: <4b1e2b75$0$6732$9b4e6d93@newsspool2.arcor-online.net>
Organization: Arcor
NNTP-Posting-Date: 08 Dec 2009 11:33:25 CET
NNTP-Posting-Host: b6704239.newsspool2.arcor-online.net
X-Trace: 
 DXC=4MPS0RIPm8O2:OR3:3gaE@A9EHlD;3YcB4Fo<]lROoRA8kF<OcfhCOK]h7Q6OFOCPKnc\616M64>JLh>_cHTX3jMY90ajka<b1O
X-Complaints-To: usenet-abuse@arcor.de
Xref: g2news1.google.com comp.lang.ada:8350
Date: 2009-12-08T11:33:25+01:00
List-Id: <comp.lang.ada>

Dmitry A. Kazakov schrieb:
> On Tue, 08 Dec 2009 11:06:54 +0100, Georg Bauhaus wrote:
> 
>> Dmitry A. Kazakov schrieb:
>>> In my view pre-/postconditions and
>>> invariants should be static, used strictly for program correctness proofs.
>>> Subtypes should complement them for dynamic run-time checks (recoverable
>>> faults).
>> Hm. What would be your subtype based expression for
>>
>>   generic
>>      type E is private;
>>   package Stacks  is
>>
>>     type Stack is private;
>>
>>     procedure push (Modified_Stack : in out Stack;
>>                     Another : Element)
>>          with pre => not Full (Modified_Stack),
>>               post => Size (Modified_Stack'Exit) = Size (Modified_Stack);
>>
>>     procedure pop (Modified_Stack : in out Stack)
>>          with pre => not Empty (Modified_Stack),
>>               post => Empty (Modified_Stack);
> 
> None. The above is wrong. You cannot implement this contract (if we deduced
> one from the given pre- and postconditions). Proof:
> 
>    loop
>       Push (Stack, X);
>    end loop;
> 
> q.e.d.
> 
> Therefore the contract of a stack must always contain ideals, e.g.
> 
> 1. exceptions, like Full_Error, Empty_Error;

I understand that exceptions are implied by Eiffel style
conditions.

The Eiffel camp might answer, for example,

    Lock (Stack);

    while not Full (Stack) loop
        Push (Stack, X);
    end loop;

    Unlock (Stack);

q.e.d.

> 2. blocked states, like holding the caller until the stack state is changed
> from another task.

Would you want this to be possible with Ada, or with SPARK? ;-)

> 
> Pre- and psotconditions are to be used to prove a contract to hold. They
> themselves are no contract.

In Eiffel, pre post and inv are used to write a contract.
The proof obligation rests on the programmer.