From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM
	autolearn=ham autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,ec6f74e58e86b38b
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII
Path: 
 g2news2.google.com!postnews.google.com!f13g2000vbm.googlegroups.com!not-for-mail
From: Phil Thornley <phil.jpthornley@googlemail.com>
Newsgroups: comp.lang.ada
Subject: Re: Lost in translation (with SPARK user rules)
Date: Thu, 27 May 2010 06:38:27 -0700 (PDT)
Organization: http://groups.google.com
Message-ID: 
 <8e9dc3eb-1460-4a3b-8cf9-af4565af5fc4@f13g2000vbm.googlegroups.com>
References: <op.vda45rsfule2fv@garhos>
 <0466e131-cc80-4db4-b080-eec9aefcb1c7@z17g2000vbd.googlegroups.com>
	<op.vda7dlc2ule2fv@garhos> <op.vdcuhhymule2fv@garhos>
 <op.vdc1x3ctule2fv@garhos>
	<Pine.LNX.4.64.1005271420410.30605@medsec1.medien.uni-weimar.de>
	<ecb1930e-58eb-47e3-9a5f-c6eb12793fe0@a20g2000vbc.googlegroups.com>
	<op.vdc6nv2ixmjfy8@garhos>
NNTP-Posting-Host: 80.177.171.182
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Trace: posting.google.com 1274967508 14606 127.0.0.1 (27 May 2010 13:38:28
 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Thu, 27 May 2010 13:38:28 +0000 (UTC)
Complaints-To: groups-abuse@google.com
Injection-Info: f13g2000vbm.googlegroups.com; posting-host=80.177.171.182;
	posting-account=Fz1-yAoAAACc1SDCr-Py2qBj8xQ-qC2q
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64;
	Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR
	3.0.30729; Media Center PC 6.0),gzip(gfe)
Xref: g2news2.google.com comp.lang.ada:12084
Date: 2010-05-27T06:38:27-07:00
List-Id: <comp.lang.ada>

On 27 May, 13:36, Yannick Duch=EAne (Hibou57) <yannick_duch...@yahoo.fr>
wrote:
> Le Thu, 27 May 2010 13:57:58 +0200, Phil Thornley =A0
> <phil.jpthorn...@googlemail.com> a =E9crit:> So my approach is now to cre=
ate user rules so that the Simplfier
> > proves 100% of the VCs. =A0However this sometimes requires quite comple=
x
> > user rules that are difficult validate manually, so I use the Proof
> > Checker to validate those rules by creating VCs that correspond to the
> > rule and proving those.
>
> This is close to my personal wish too, except I see a slight difference :=
 =A0
> I prefer to write very simple user rules, easily proved (like as easy to =
=A0
> prove as using a truth table) and write Check based demonstrations relyin=
g =A0
> on these rules. This is because I feel it is more safe (enforce soundness=
) =A0
> and because it left more in the source in less in external documents (doe=
s =A0
> not brake source navigability and layout logic).

I very much agree with this approach - adding a sequence of check
annotations so that the rules required are easy to validate. However
you have to balance this against the size of the annotations required.

For example, a few years ago I was trying to prove the correctness of
code for a red-black tree, the single rotation procedure was four
lines of code, but it took about 60 lines of check annotations plus a
bunch of quite complex rules, to prove that the tree stayed a valid
binary tree (and I never got round to proving the colour invariants).

Cheers,

Phil