From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM autolearn=ham autolearn_force=no version=3.4.4 X-Google-Thread: 103376,af40877501f46910 X-Google-NewGroupId: yes X-Google-Attributes: gida07f3367d7,domainid0,public,usenet X-Google-Language: ENGLISH,UTF8 Path: g2news1.google.com!news4.google.com!feeder.news-service.com!weretis.net!feeder4.news.weretis.net!news.mixmin.net!aioe.org!not-for-mail From: =?utf-8?Q?Yannick_Duch=C3=AAne_=28Hibou57?= =?utf-8?Q?=29?= Newsgroups: comp.lang.ada Subject: Re: SPARK understand me very well... me neither Date: Sat, 14 Aug 2010 22:48:05 +0200 Organization: Ada At Home Message-ID: References: <2308d0a0-8fdb-41a0-b2dc-6b30a2bf2f18@v41g2000yqv.googlegroups.com> NNTP-Posting-Host: vW41ugf3bPGxhjQJ6q2hXA.user.speranza.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes Content-Transfer-Encoding: Quoted-Printable X-Complaints-To: abuse@aioe.org X-Notice: Filtered by postfilter v. 0.8.2 User-Agent: Opera Mail/10.61 (Win32) Xref: g2news1.google.com comp.lang.ada:13299 Date: 2010-08-14T22:48:05+02:00 List-Id: Le Sat, 14 Aug 2010 21:08:43 +0200, Phil Thornley = a =C3=A9crit: >> Le Sat, 14 Aug 2010 18:04:23 +0200, Phil Thornley = >> a =C3=A9crit: > [...] >> > For this particular example, I don't understand why you haven't use= d >> > the obvious precondition: >> > --# pre A * B in Integer; >> >> Because I did not knew this was feasible. > OK - that seems a pretty good reason :-) If you feel so, nothing bad so :) But what seems important to me and I would to underline, was also that i= f = I did not knew this was possible, this was because it was fr from my min= d. = And this was far from my mind, because looking at it as-is, I would have= = said =E2=80=9Cwhat does it prove ? what does it offer ?=E2=80=9D. In sho= rt, this looks = like a bad logical interface to me. Well, as said, the case is special here : an example posted at Rosetta, = = and this have special requirements. But if this was for a real project, I am pretty sure I would have insist= ed = to go on with a pre-condition which would have offered something = (something to help the client of the function to setup a valid context o= r = to prove a given invokation context is valid). As-is, I feel this simply= = discharge all of the proof responsibility on the client side. That is wh= y = this kind of idea was very far from my mind. Otherwise, about the use of= " = ... in Type_Name" in a Check or Assert SPARK annotation, this is thing = already done multiple me for me. This was just in the particular context= , = the one of a --# pre annonation, I've never imagine this could be an = option. By the way, that is true the proof may become very complex (at least = relatively compared to the function is applies to). But it goes with pro= of = as it goes with implementation : once done, this is done and you can inv= ok = the method/function as many time as you want. The pre-condition also may seems complex too. But this may be valuable, = or = be a better logical interface in the long run, if this help the clients = to = figure out how and when the function may be legitimately used. That is t= he = purpose of an interface after all. I do not mean I desagree with you here, I just do not want to focus too = = much on that =E2=80=9CI did not knew it was possible=E2=80=9D which is m= ostly anecdotal = here. The reason why I did not had this alternative in mind is far more = = important. I feel we understand each other on this point any way. Just wanted to = makes it explicit. I have also opened a thread on fr.comp.lang.ada based on this experience= = and your valuable comments, just to get more opportunity to have talks = about =E2=80=9CThe Art and the Way to do=E2=80=9D, as I feel there are f= ar too much few = about it :( (I mean, not enough talks and experiences testimony about = SPARK). Have a nice day! :) Yannick