Question

我想证明此过程中的循环将使用变体（绑定函数）终止

变量将为I，下界为0 （I：= 0）
在每次重复中，I的大小将减小，直到达到下限0 如何证明I在此循环中会减少？

procedure Find
   (Key: Integer;
    Data : in MyArray;
    Index: out Integer;
    Found: out Boolean)
    --# post (Found -> Data(Index) = Key);
is
   I: Integer;
begin
   I := 0;
   Found := False;
   loop
      --# assert (I >= 0) and
      --# (I <= Data'Last + 1) and
      --# (Found -> Data(I) = Key);
      exit when (I > Data 'Last) or Found;
      if(Data(I)) = Key
      then
         Found := True;
      else
         I:= I + 1;
      end if;
   end loop;
   Index := I;
end Find;

Answer 1

我不确定您所说的“变体”和“绑定功能”是什么意思，并且我无权访问您的SPARK版本。

在带有GNAT CE 2018的SPARK 2014中，这证明了（经过很多痛苦，也许我应该研究一些SPARK教程）而没有任何循环不变式。

如果我反向运行循环，我想不用Supported_Range就可以逃脱。

我希望将后置条件中的True替换为(for all D of Data => D /= Key)，但我会保留它。

很抱歉，这无法回答您的问题。

package Memo with SPARK_Mode is
   subtype Supported_Range is Natural range 0 .. Natural'Last - 1;
   type My_Array is array (Supported_Range range <>) of Integer;
   procedure Find
     (Key   :     Integer;
      Data  :     My_Array;
      Index : out Integer;
      Found : out Boolean)
   with
     Pre => Data'Length >= 1,
     Post => ((Found and then Index in Data'Range and then Data (Index) = Key)
              or else True);
end Memo;

package body Memo with SPARK_Mode is
   procedure Find
     (Key   :     Integer;
      Data  :     My_Array;
      Index : out Integer;
      Found : out Boolean)
   is
      subtype Possible_J is Integer range Data’Range;
      J : Possible_J;
   begin
      J := Possible_J'First;
      Index := -1;  -- have to initialize with something
      Found := False;
      loop
         if Data (J) = Key
         then
            Found := True;
            Index := J;
            exit;
         else
            exit when J = Data'Last;
            J := J + 1;
         end if;
      end loop;
   end Find;
end Memo;

Answer 2

如果我用典型的Ada习惯用法写这个，我就会明白

package SPARK_Proof is
   type Integer_List is array (Positive range <>) of Integer;

   type Find_Result (Found : Boolean := False) is record
      case Found is
      when False =>
         null;
      when True =>
         Index : Positive;
      end case;
   end record;

   function Match_Index (Value : Integer; List : Integer_List) return Find_Result;
end SPARK_Proof;

package body SPARK_Proof is
   function Match_Index (Value : Integer; List : Integer_List) return Find_Result is
      -- Empty
   begin -- Match_Index
      Search : for I in List'Range loop
         if Value = List (I) then
            return (Found => True, Index => I);
         end if;
      end loop Search;

      return (Found => False);
   end Match_Index;
end SPARK_Proof;

这更短更清晰。我不知道用SPARK证明是否更容易。

Answer 3

我将使用有界循环构造（for循环）遍历数组。 for循环可以更轻松地处理数组边界和空数组。这对我来说适用于GNAT CE 2018（在此处使用SPARK 2014）：

package Foo with SPARK_Mode => On is

   type MyArray is array (Integer range <>) of Integer;

   procedure Find
     (Key   : in  Integer;
      Data  : in  MyArray;
      Index : out Integer;
      Found : out Boolean)
     with       
       Post => (if Found then Data (Index) = Key);

end Foo;

和

package body Foo with SPARK_Mode => On is

   ----------
   -- Find --
   ----------

   procedure Find
     (Key   : in  Integer;
      Data  : in  MyArray;
      Index : out Integer;
      Found : out Boolean)
   is
   begin

      Found := False;
      Index := Data'First;

      for I in Data'Range loop

         if Data (I) = Key then
            Found := True;   
            Index := I;
         end if;       

         pragma Loop_Invariant
           (Index in Data'Range);

         pragma Loop_Invariant
           (if Found then Data (Index) = Key else Data (Index) /= Key);        

         exit when Found;
      end loop;

   end Find;

end Foo;

验证回路终止

3 个答案: