From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00
	autolearn=unavailable autolearn_force=no version=3.4.4
Path: 
 eternal-september.org!reader01.eternal-september.org!reader02.eternal-september.org!news.eternal-september.org!mx02.eternal-september.org!feeder.eternal-september.org!gandalf.srv.welterde.de!news.jacob-sparre.dk!loke.jacob-sparre.dk!pnx.dk!.POSTED!not-for-mail
From: Jacob Sparre Andersen <jacob@jacob-sparre.dk>
Newsgroups: comp.lang.ada
Subject: Re: {Pre,Post}conditions and side effects
Date: Fri, 24 Apr 2015 16:40:24 +0200
Organization: Jacob Sparre Andersen Research & Innovation
Message-ID: <87oamdlhd3.fsf@adaheads.sparre-andersen.dk>
References: <2430252d-52a1-4609-acef-684864e6ca0c@googlegroups.com>
	<AnYlw.957256$Rp.242412@fx23.iad>
	<0a718b39-ebd3-4ab5-912e-f1229679dacc@googlegroups.com>
	<wccoaqucn51.fsf@shell01.TheWorld.com>
	<9ee5e186-5aaa-4d07-9490-0f9fdbb5ca18@googlegroups.com>
	<alpine.CYG.2.11.1412231747100.4196@WIL414CHAPIN.vtc.vsc.edu>
	<wccegrpq2om.fsf@shell01.TheWorld.com>
	<87tww5296f.fsf@adaheads.sparre-andersen.dk>
	<mhdbpc$pl6$1@dont-email.me>
NNTP-Posting-Host: 195.249.206.131
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: loke.gir.dk 1429886424 590 195.249.206.131 (24 Apr 2015 14:40:24 GMT)
X-Complaints-To: news@jacob-sparre.dk
NNTP-Posting-Date: Fri, 24 Apr 2015 14:40:24 +0000 (UTC)
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux)
Cancel-Lock: sha1:BU6COyfS/zSXdMnqqb7Ldts2AdA=
Xref: news.eternal-september.org comp.lang.ada:25596
Date: 2015-04-24T16:40:24+02:00
List-Id: <comp.lang.ada>

"G.B." <bauhaus@futureapps.invalid> wrote:

[...]

> Last but not least, a precondition should never be anything but an
> assumption. As not checking it at run-time is a valid way of handling
> preconditions, the outcome of not tesing should still not create
> havoc; so, the caller needs to make sure that assertion of the
> contract is always true, and never depend on how it is tested, or on
> that it is tested.

Taking that view, there isn't any point combining the contract notation
of Ada 2012 and SPARK 2014, as it would prevent you from writing a
single source text which was valid for both languages.

SPARK would complain about your in-subprogram check (mirroring the
precondition), as raising an exception is illegal in SPARK (and dead
code probably is as well).

Greetings,

Jacob
--
"[...] *transfer* a bit of salary from the person who writes
 a bug to the person that finds a bug..." -- Keith Ray