Re: SPARK 2014 and protected objects

[Simon Wright <simon@pushface.org>]

Simon Wright <simon@pushface.org> writes:

> What is a non-external state?

This version proves OK. Note the (State with External). I _think_ that
Protected_Value and Impl's spec, being Part_Of State, have to be in the
same declarative region (i.e. not the body).

package PO
with Spark_Mode => On,
  Abstract_State => (State with External),
  Initializes => State
is

   procedure Set (Value : Integer)
     with Depends => (State =>+ Value);

   procedure Get (Value : out Integer)
     with Depends => (State => State,
                      Value => State);

private

   Protected_Value : Integer := 0
     with Volatile,
     Part_Of => State;

   protected Impl
     with Part_Of => State
   is
      procedure Set (Value : Integer)
        with Depends => (Impl => Impl,
                         Protected_Value => Value);
      procedure Get (Value : out Integer)
        with Depends => (Impl => Impl,
                         Protected_Value => Protected_Value,
                         Value => Protected_Value);
   end Impl;

end PO;

package body PO
with Spark_Mode => On,
  Refined_State => (State => (Protected_Value,
                              Impl))
is

   procedure Set (Value : Integer) is
   begin
      Impl.Set (Value);
   end Set;

   procedure Get (Value : out Integer) is
   begin
      Impl.Get (Value);
   end Get;

   protected body Impl is
      procedure Set (Value : Integer) is
      begin
         Protected_Value := Value;
      end Set;

      procedure Get (Value : out Integer) is
      begin
         Value := Protected_Value;
      end Get;
   end Impl;

end PO;