From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM
	autolearn=ham autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,48e1a3c594fb62e8
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,UTF8
Path: 
 g2news2.google.com!news3.google.com!proxad.net!feeder1-2.proxad.net!usenet-fr.net!gegeweb.org!aioe.org!not-for-mail
From: =?utf-8?Q?Yannick_Duch=C3=AAne_=28Hibou57?=
 =?utf-8?Q?=29?=
 <yannick_duchene@yahoo.fr>
Newsgroups: comp.lang.ada
Subject: Re: SPARK
Date: Sun, 16 May 2010 03:48:53 +0200
Organization: Ada At Home
Message-ID: <op.vcrzbrzpule2fv@garhos>
References: <op.vcl6900wule2fv@garhos> <op.vcrqy7isule2fv@garhos>
NNTP-Posting-Host: sTlYSXnTcjJGTYbLtvdIYA.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: Quoted-Printable
X-Complaints-To: abuse@aioe.org
X-Notice: Filtered by postfilter v. 0.8.2
User-Agent: Opera Mail/10.53 (Win32)
Xref: g2news2.google.com comp.lang.ada:11653
Date: 2010-05-16T03:48:53+02:00
List-Id: <comp.lang.ada>

Le Sun, 16 May 2010 00:48:33 +0200, Yannick Duch=C3=AAne (Hibou57)  =

<yannick_duchene@yahoo.fr> a =C3=A9crit:

> Ok, from some branch of this thread, you may have learned a question  =

> have raised about which one of =E2=80=9Cassert=E2=80=9D or =E2=80=9Cch=
eck=E2=80=9D should be used to  =

> write in-text proofs where the Simplifier could not prove it it/his/he=
r  =

> self.
>
> The answer to this is so much important that I give the answer to it  =

> from the root of this thread, instead of from the latter leaf.
>
> So it is : Use Check, not Assert.
> [...]

Part 6 of Phil's document says:

> For both check and assert, there is a VC generated that has
> the current program state as hypotheses and the <Boolean
> expression> as the conclusion.
I've meet something different (see previous messages in this thread), or=
  =

at least, the current state is not represented with the same set of  =

hypotheses.


> For code that does not contain any loops, there is
> (in principle) never any need for either of these
> annotations since they cannot make unprovable VCs
> into provable VCs.
Sorry, I can't buy that at all. I could make VCs provable, and this was =
 =

otherwise not provable by the simplifier, using Check clauses.

Sorry friend, I'm not dreaming : this really happened.

-- =

There is even better than a pragma Assert: a SPARK --# check.

Wanted: if you know about some though in the area of comparisons between=
  =

SPARK and VDM, please, let me know. Will enjoy to talk with you about it=
.