From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM autolearn=ham autolearn_force=no version=3.4.4 X-Google-Thread: a07f3367d7,48e1a3c594fb62e8 X-Google-Attributes: gida07f3367d7,public,usenet X-Google-NewGroupId: yes X-Google-Language: ENGLISH,UTF8 Path: g2news2.google.com!news4.google.com!proxad.net!feeder1-2.proxad.net!usenet-fr.net!gegeweb.org!aioe.org!not-for-mail From: =?utf-8?Q?Yannick_Duch=C3=AAne_=28Hibou57?= =?utf-8?Q?=29?= Newsgroups: comp.lang.ada Subject: Re: SPARK Date: Sun, 16 May 2010 00:48:33 +0200 Organization: Ada At Home Message-ID: References: NNTP-Posting-Host: sTlYSXnTcjJGTYbLtvdIYA.user.speranza.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes Content-Transfer-Encoding: Quoted-Printable X-Complaints-To: abuse@aioe.org X-Notice: Filtered by postfilter v. 0.8.2 User-Agent: Opera Mail/10.53 (Win32) Xref: g2news2.google.com comp.lang.ada:11651 Date: 2010-05-16T00:48:33+02:00 List-Id: Ok, from some branch of this thread, you may have learned a question hav= e = raised about which one of =E2=80=9Cassert=E2=80=9D or =E2=80=9Ccheck=E2=80= =9D should be used to write = in-text proofs where the Simplifier could not prove it it/his/her self. The answer to this is so much important that I give the answer to it fro= m = the root of this thread, instead of from the latter leaf. So it is : Use Check, not Assert. Here is a concrete example of what you can do with Check and which does = = not work with Assert. The example is detailed, I mean, exposes detailed = = proofs, over what may have been sufficient. This is because I like = explicit and expressive things, and this was also to be sure nobody coul= d = miss a single step of the proof and nobody could have any doubt about th= e = usefulness of such a approach in software conception. That's also the = reason why the exercise upon which this is based, was a bit modified (li= ke = using two intermediate variables instead of subexpressions.. I do that = oftenly on my side). Here is : procedure Limit (X : in out Integer; Lower : in Integer; Upper : in Integer) --# pre Lower < Upper; --# post ((X~ < Lower) -> (X =3D Lower)) and --# ((X~ > Upper) -> (X =3D Upper)) and --# (X in Lower .. Upper); is begin if X < Lower then X :=3D Lower; elsif X > Upper then X :=3D Upper; end if; end Limit; function Percent_Of_Range (Data : Integer; Lowest : Integer; Highest : Integer) return Percent_Type --# pre (Lowest < Highest) and --# ((Highest - Lowest) <=3D Integer'Last) and --# (((Highest - Lowest) * 100) <=3D Integer'Last); is Local_Data : Integer; Part : Integer; Whole : Integer; begin Local_Data :=3D Data; -- Local copy of Data to be allowed to modify it. We only need -- a modified version locally, the caller does not need this. Limit (X =3D> Local_Data, -- in out. Lower =3D> Lowest, -- in Upper =3D> Highest); -- in. Part :=3D Local_Data - Lowest; Whole :=3D Highest - Lowest; -- We are to prove that ((Part * 100) / Whole) is in 0 .. 100. -- (1) Prove that Part >=3D 0. --# check Local_Data in Lowest .. Highest; --# check Local_Data >=3D Lowest; --# check (Local_Data - Lowest) >=3D 0; --# check Part >=3D 0; -- Given (1), it's obvious that (Part * 100) >=3D 0. -- (2) Prove that Whole is > 0. --# check Lowest < Highest; --# check Highest > Lowest; --# check (Highest - Lowest) > 0; --# check Whole > 0; -- Given (2), it's obvious that ((Part * 100) / Whole) is valid. -- Given (1) and (2), it's obvious that ((Part * 100) / Whole) >=3D= 0. -- (3) Prove that (Whole >=3D Part). This is required for (4) whi= ch is -- to come. --# check Local_Data in Lowest .. Highest; --# check Highest >=3D Local_Data; --# check (Highest - Lowest) >=3D (Local_Data - Lowest); --# check Whole >=3D Part; -- (4) Prove that ((Part * 100) / Whole) is less or equal to 100.= --# check Part <=3D Whole; --# check (Part * 100) <=3D (Whole * 100); --# check ((Part * 100) / Whole) <=3D ((Whole * 100) / Whole); --# check ((Part * 100) / Whole) <=3D 100; -- (5) Prove that the subexpression (Part * 100) will not -- commit an overflow. --# check (((Highest - Lowest) * 100) <=3D Integer'Last); --# check (Whole * 100) <=3D Integer'Last; --# check Part <=3D Whole; --# check (Part * 100) <=3D Integer'Last; -- Given (1), we know ((Part * 100) / Whole) >=3D 0. -- Given (4), we know ((Part * 100) / Whole) <=3D 100. -- Given (5), we we know (Part * 100) will not commit an overflow= . -- Given (1) and (2) and(5), the following statement is then prov= ed = to -- be valid and meaningful. return Percent_Type ((Part * 100) / Whole); end Percent_Of_Range; A working example of a step by step proof of every things required to be= = proven. Waaw... I like it so much, I love it. This is the way I was thinking = software should be built for so long ! I was waiting for such a thing fo= r = about 14 years you know ! I use to learn about VDM when I was younger, hire books about it in = libraries, use to think about creating my own implementation of VDM, but= = failed to find the language specification (and was frightened about the = = idea to setup my own language in this area). And now, I see SPARK can do nearly the same. Well, although wonderful, that's still not perfect : why is there a = Checker (which I didn't used here) and why no provision to write in-text= = what is done with the Checker ? That's what I was attempting to do here.= = It works, but I miss something like explicit =E2=80=9Cfrom (1) and (2) i= nfer .... = =E2=80=9D etc. I cannot give names or numbers to Check clauses and canno= t = explicitly refer to these. I cannot nor explicitly refer to precondition= = in inferences (like in (5), where the reference to a precondition is = implicit, not explicit). Is there some provision for such a thing ? Yes, I may wish too much... that's not perfect, while still wonderful. D= o = you feel too ? :) -- = There is even better than a pragma Assert: an --# assert (or a --# = check... question pending)