From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00
	autolearn=unavailable autolearn_force=no version=3.4.4
Path: 
 eternal-september.org!reader01.eternal-september.org!reader02.eternal-september.org!news.eternal-september.org!news.eternal-september.org!news.eternal-september.org!feeder.eternal-september.org!nntp-feed.chiark.greenend.org.uk!ewrotcd!reality.xs3.de!news.jacob-sparre.dk!loke.jacob-sparre.dk!pnx.dk!.POSTED!not-for-mail
From: Jacob Sparre Andersen <jacob@jacob-sparre.dk>
Newsgroups: comp.lang.ada
Subject: SPARK vs. Ada 2012 for static analysis (Was: Ada 2012 talk at
 DANSAS'13)
Date: Thu, 15 Aug 2013 15:02:17 +0200
Organization: Jacob Sparre Andersen Research & Innovation
Message-ID: <87eh9vxg2u.fsf_-_@adaheads.sparre-andersen.dk>
References: <87mwojxs80.fsf@adaheads.sparre-andersen.dk>
	<7xzjsjckgf.fsf@ruckus.brouhaha.com>
NNTP-Posting-Host: monowall.adaheads.com
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: loke.gir.dk 1376571737 18209 86.48.41.195 (15 Aug 2013 13:02:17 GMT)
X-Complaints-To: news@jacob-sparre.dk
NNTP-Posting-Date: Thu, 15 Aug 2013 13:02:17 +0000 (UTC)
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux)
Cancel-Lock: sha1:FmIqSEbch9DBnQuCfV4apOk9o4g=
Xref: news.eternal-september.org comp.lang.ada:16877
Date: 2013-08-15T15:02:17+02:00
List-Id: <comp.lang.ada>

Paul Rubin wrote:

> Does SPARK-2014 help?  I'm not sure if it exists yet, but I gather
> GNATProve (which is out there) is some kind of precursor to it.

SPARK would of course give compile/analysis-time checking, but we don't
consider it appropriate for the project.  The cost of implementing
sockets and containers in SPARK alone would probably kill that idea.

I'm not sure SPARK-2014 wasn't announced when we started the project,
and I don't consider it ready for real-life use yet, as tasking isn't
covered yet.

We want as much static analysis as we can get, but we are at the same
time working in a context where the value of making an "absolutely
perfect" application isn't that much bigger than writing a "definitely
above average reliability" application.  The whole system also depends
on other parts, which may fail too.  As long as we have a few orders of
magnitude fewer failures than the other parts, we are quite happy.

As I see things, the important place for complete static analysis
(i.e. SPARK) is in components which have a unique possibility of
breaking your system.  One obvious example is a PRNG used for
cryptography; if it is broken, your whole system is broken, and nothing
else can break the system in quite the same way.

Greetings,

Jacob
-- 
»You know the world has gone crazy when the best rapper is a
 white guy, the best golfer is a black guy, the swiss hold
 the America's cup, France is accusing the U.S. of
 arrogance, and Germany doesn't want to go to war«