From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM
	autolearn=ham autolearn_force=no version=3.4.4
X-Google-Thread: a07f3367d7,ec6f74e58e86b38b
X-Google-Attributes: gida07f3367d7,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII
Path: 
 g2news2.google.com!news4.google.com!proxad.net!feeder1-2.proxad.net!usenet-fr.net!gegeweb.org!aioe.org!not-for-mail
From: =?iso-8859-15?Q?Yannick_Duch=EAne_=28Hibou57=29?=
 <yannick_duchene@yahoo.fr>
Newsgroups: comp.lang.ada
Subject: Re: Lost in translation (with SPARK user rules)
Date: Thu, 03 Jun 2010 04:44:50 +0200
Organization: Ada At Home
Message-ID: <op.vdpdw0taxmjfy8@garhos>
References: <op.vda45rsfule2fv@garhos>
 <0466e131-cc80-4db4-b080-eec9aefcb1c7@z17g2000vbd.googlegroups.com>
 <op.vda7dlc2ule2fv@garhos> <op.vdcuhhymule2fv@garhos>
 <op.vdc1x3ctule2fv@garhos>
 <Pine.LNX.4.64.1005271420410.30605@medsec1.medien.uni-weimar.de>
 <ecb1930e-58eb-47e3-9a5f-c6eb12793fe0@a20g2000vbc.googlegroups.com>
 <op.vdc6nv2ixmjfy8@garhos>
 <8e9dc3eb-1460-4a3b-8cf9-af4565af5fc4@f13g2000vbm.googlegroups.com>
NNTP-Posting-Host: si1wcqmfPAlDmjwCD+0L/g.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes
Content-Transfer-Encoding: Quoted-Printable
X-Complaints-To: abuse@aioe.org
X-Notice: Filtered by postfilter v. 0.8.2
User-Agent: Opera Mail/10.53 (Win32)
Xref: g2news2.google.com comp.lang.ada:12208
Date: 2010-06-03T04:44:50+02:00
List-Id: <comp.lang.ada>

Le Thu, 27 May 2010 15:38:27 +0200, Phil Thornley  =

<phil.jpthornley@googlemail.com> a =E9crit:
> I very much agree with this approach - adding a sequence of check
> annotations so that the rules required are easy to validate. However
> you have to balance this against the size of the annotations required.=

>
> For example, a few years ago I was trying to prove the correctness of
> code for a red-black tree, the single rotation procedure was four
> lines of code, but it took about 60 lines of check annotations plus a
> bunch of quite complex rules, to prove that the tree stayed a valid
> binary tree (and I never got round to proving the colour invariants).
At least, I've noticed that while user rules can have an impact on speed=
  =

of Simplifier, this is not the most important. Check (and so assert also=
)  =

seems to have the most significant impact. What is worth to note : a lon=
g  =

and explicit proof does not implies it is a slower one (the Simplifier i=
s  =

mostly slow when it fails to prove something, and is faster when it  =

success).

-- =

There is even better than a pragma Assert: a SPARK --# check.
--# check C and WhoKnowWhat and YouKnowWho;
--# assert Ada;
--  i.e. forget about previous premises which leads to conclusion
--  and start with new conclusion as premise.