From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM
	autolearn=ham autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,d4e6b104ff087788
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,UTF8
Path: 
 g2news2.google.com!news4.google.com!feeder.news-service.com!news.mixmin.net!aioe.org!not-for-mail
From: =?utf-8?Q?Yannick_Duch=C3=AAne_=28Hibou57?=
 =?utf-8?Q?=29?=
 <yannick_duchene@yahoo.fr>
Newsgroups: comp.lang.ada
Subject: Re: SPARK : surprising failure with implication
Date: Thu, 03 Jun 2010 13:19:25 +0200
Organization: Ada At Home
Message-ID: <op.vdp1qnulule2fv@garhos>
References: <op.vdmxbejnule2fv@garhos> <op.vdnz65ucule2fv@garhos>
 <op.vdpu1pw0xmjfy8@garhos>
NNTP-Posting-Host: NJ7dT1FfHACzonSNRpah0A.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: Quoted-Printable
X-Complaints-To: abuse@aioe.org
X-Notice: Filtered by postfilter v. 0.8.2
User-Agent: Opera Mail/10.53 (Win32)
Xref: g2news2.google.com comp.lang.ada:12222
Date: 2010-06-03T13:19:25+02:00
List-Id: <comp.lang.ada>

Le Thu, 03 Jun 2010 10:54:51 +0200, Yannick Duch=C3=AAne (Hibou57)  =

<yannick_duchene@yahoo.fr> a =C3=A9crit:
> The original context in Ada/SPARK source is of the form (the above C1 =
 =

> stands for the Check clause):
>
>     --# assert ..... U'Pos (Result + 1) .....
>     .....
>     Result :=3D Result + 1;
>     .....
>     --# check .... U'Pos (Result + 1 + 1) ....

If you meet a similar case as the above message, the only workable  =

workaround seems to use an intermediate variable like in:

     --# assert ..... U'Pos (Result + 1) .....
     .....
     Previous_Result :=3D Result;
     Result :=3D Previous_Result - 1;
     .....
     --# check .... U'Pos (Previous_Result + 1) ....

I suppose some of you guessed this in an extract of a loop (the Check  =

clause is the start of the proof of a loop invariant).

BTW, I've made a mistake in the previous transcription, this was =E2=80=9C=
Result  =

:=3D Result - 1;=E2=80=9D (sorry for that)

I will not give other examples, I will just say using intermediate  =

variables oftenly help with SPARK. But take care: while doing so, avoid =
to  =

introduce additional RTC VC which will turn your proof into a more  =

complicated story, and to avoid this misadventure, you should only use  =

this technique to backup previous values of a variable which is modified=
  =

since a previous Assert clause (a copy between two variables of the same=
  =

type does not introduce RTC VC, so it's OK).

Have a nice day all.

-- =

There is even better than a pragma Assert: a SPARK --# check.
--# check C and WhoKnowWhat and YouKnowWho;
--# assert Ada;
--  i.e. forget about previous premises which leads to conclusion
--  and start with new conclusion as premise.