Question

如何为一个对数组元素求和的函数编写Spark后置条件？（Spark 2014，但如果有人告诉我如何为早期的Spark做这件事我应该能够适应它。）

所以，如果我有：

type Positive_Array is array (Positive range <>) of Positive;

function Array_Total(The_Array: Positive_Array) return Positive
with
  Post => Array_Total'Return = -- What goes here?
is
  -- and so on

在我的特定情况下，我不需要担心溢出（我知道初始化时的总数是多少，而且只能单调减少）。

据推测，我需要在实现中使用一个循环变体来帮助证明者，但这应该是后置条件的直接变化，所以我还没有担心。

Answer 1

编写后置条件的一种方法可以是递归函数。这样可以避免实现和规范完全相同的问题。

Answer 2

这是一个古老而有趣的问题。这是一个较晚的答案，仅供参考，以供将来参考。

AdaCore网站上发布的博客文章Taking on a Challange in SPARK中给出了有关如何解决此类问题的主要“技巧”。

与某些答案已经建议的相反，您不能使用递归函数来证明求和。相反，您需要一个ghost function，如下例所示。可以扩展该方法，以证明类似的“列表折叠”操作，例如（条件）计数。

下面的示例可以通过GNAT CE 2019和努力级别1来证明。

sum.ads

package Sum with SPARK_Mode is

   --  The ranges of the list's index and element discrete types must be
   --  limited in order to prevent overflow during summation, i.e.:
   --
   --     Nat'Last * Int'First >= Integer'First   and
   --     Nat'Last * Int'Last  <= Integer'Last
   --
   --  In this case +/-1000 * +/-1000 = +/-1_000_000 which is well within the 
   --  range of the Ada Integer type on typical platforms.

   subtype Int is Integer range -1000 .. 1000;
   subtype Nat is Integer range     1 .. 1000;

   type List is array (Nat range <>) of Int;


   --  The function "Sum_Acc" below is Ghost code to help the prover proof the
   --  postcondition (result) of the "Sum" function. It computes a list of
   --  partial sums. For example:
   --
   --           Input   :  [ 1  2  3  4  5  6 ]
   --           Output  :  [ 1  3  6 10 15 21 ]
   --
   --  Note that the lengths of lists are the same, the first elements are
   --  identical and the last element of the output (here: "21"), is the
   --  result of the actual function under consideration, "Sum".
   --
   --  REMARK: In this case, the input of "Sum_Acc" and "Sum" is limited
   --          to non-empty lists for convenience.

   type Partial_Sums is array (Nat range <>) of Integer;

   function Sum_Acc (L : List) return Partial_Sums with 
     Ghost,
     Pre  =>  (L'Length > 0),
     Post =>  (Sum_Acc'Result'Length = L'Length) 
     and then (Sum_Acc'Result'First = L'First) 
     and then (for all I in L'First .. L'Last =>
                 abs (Sum_Acc'Result (I)) <= I * Int'Last)
     and then Sum_Acc'Result (L'First) = L (L'First)
     and then (for all I in L'First + 1 .. L'Last =>
                 Sum_Acc'Result (I) = Sum_Acc'Result (I - 1) + L (I));


   function Sum (L : List) return Integer with
     Pre  => L'Length > 0,
     Post => Sum'Result = Sum_Acc (L) (L'Last);

end Sum;

sum.adb

package body Sum with SPARK_Mode is

   -------------
   -- Sum_Acc --
   -------------

   function Sum_Acc (L : List) return Partial_Sums is
      PS : Partial_Sums (L'Range) := (others => 0);
   begin

      PS (L'First) := L (L'First);

      for Index in L'First + 1 .. L'Last loop

         --  Head equal.
         pragma Loop_Invariant
           (PS (L'First) = L (L'First));

         --  Tail equal.
         pragma Loop_Invariant
           (for all I in L'First + 1 .. Index - 1 =>
              PS (I) = PS (I - 1) + L (I)); 

         --  NOTE: The loop invariant below holds only when the range of "Int" 
         --        is symmetric, i.e -Int'First = Int'Last. If not, then this
         --        loop invariant may have to be adjusted.

         --  Result within bounds.
         pragma Loop_Invariant 
           (for all I in L'First .. Index - 1 =>
               PS (I) in I * Int'First .. I * Int'Last);

         PS (Index) := PS (Index - 1) + L (Index);

      end loop;

      return PS;

   end Sum_Acc;

   ---------
   -- Sum --
   ---------

   function Sum (L : List) return Integer is
      Result : Integer := L (L'First);
   begin

      for I in L'First + 1 .. L'Last loop

         pragma Loop_Invariant
           (Result = Sum_Acc (L) (I - 1));

         Result := Result + L (I);

      end loop;

      return Result;

   end Sum;

end Sum;

阵列总数的Spark-Ada后置条件

2 个答案: