@@ -216,7 +216,7 @@ process* [7] and so we have no way to keep them.
216
216
#### Types
217
217
218
218
In these three formats, GADTs are used to statically ensure a part of the
219
- type-corectness of the specification, in the same spirit it is done in the
219
+ type-correctness of the specification, in the same spirit it is done in the
220
220
other Copilot libraries. * copilot-theorem* handles only three types which are
221
221
` Integer ` , ` Real ` and ` Bool ` and which are handled by the SMTLib standard.
222
222
* copilot-theorem* works with * pure* reals and integers. Thus, it is unsafe in the
@@ -389,9 +389,9 @@ the model-checking techniques we are using.
389
389
#### Limitations related to Copilot implementation
390
390
391
391
The reification process used to build the ` Core.Spec ` object looses many
392
- informations about the structure of the original Copilot program. In fact, a
392
+ information about the structure of the original Copilot program. In fact, a
393
393
stream is kept in the reified program only if it is recursively defined.
394
- Otherwise, all its occurences will be inlined. Moreover, let's look at the
394
+ Otherwise, all its occurrences will be inlined. Moreover, let's look at the
395
395
` intCounter ` function defined in the example ` Grey.hs ` :
396
396
397
397
``` haskell
@@ -413,7 +413,7 @@ There are many problems with this:
413
413
* It makes the inputs given to the SMT solvers larger and repetitive.
414
414
415
415
We can't rewrite the Copilot reification process in order to avoid these
416
- inconvenients as these informations are lost by GHC itself before it occurs.
416
+ inconvenients as these information are lost by GHC itself before it occurs.
417
417
The only solution we can see would be to use * Template Haskell* to generate
418
418
automatically some structural annotations, which might not be worth the dirt
419
419
introduced.
@@ -423,7 +423,7 @@ introduced.
423
423
##### Limitations of the IC3 algorithm
424
424
425
425
The IC3 algorithm was shown to be a very powerful tool for hardware
426
- certification. However, the problems encountered when verifying softwares are
426
+ certification. However, the problems encountered when verifying software are
427
427
much more complex. For now, very few non-inductive properties can be proved by
428
428
* Kind2* when basic integer arithmetic is involved.
429
429
@@ -433,7 +433,7 @@ the inductiveness* (CTI) for a property, these techniques are used to find a
433
433
lemma discarding it which is general enough so that all CTIs can be discarded
434
434
in a finite number of steps.
435
435
436
- The lemmas found by the current version fo * Kind2* are often too weak. Some
436
+ The lemmas found by the current version of * Kind2* are often too weak. Some
437
437
suggestions to enhance this are presented in [ 1] . We hope some progress will be
438
438
made in this area in a near future.
439
439
@@ -487,7 +487,7 @@ forAllCst l f = conj $ map (f . constant) l
487
487
```
488
488
489
489
However, this solution isn't completely satisfying because the size of the
490
- property generated is proportionnal to the cardinal of ` allowed ` .
490
+ property generated is proportional to the cardinal of ` allowed ` .
491
491
492
492
#### Some scalability issues
493
493
@@ -517,7 +517,7 @@ in the Kind2 SMT solver.
517
517
Counterexamples are not displayed with the Kind2 prover because Kind2 doesn't
518
518
support XML output of counterexamples. If the last feature is provided, it
519
519
should be easy to implement counterexamples displaying in * copilot-theorem* . For
520
- this, we recommend to keep some informations about * observers* in
520
+ this, we recommend to keep some information about * observers* in
521
521
` TransSys.Spec ` and to add one variable per observer in the Kind2 output file.
522
522
523
523
#### Bad handling of non-linear operators and external functions
@@ -576,12 +576,12 @@ complexity added. It's especially true at the time I write this in the sense
576
576
that:
577
577
578
578
* Each predicate introduced is used only one time (which is true because
579
- copilot doesn't handle functions or parametrized streams like Lustre does and
579
+ copilot doesn't handle functions or parameterized streams like Lustre does and
580
580
everything is inlined during the reification process).
581
581
* A similar form of structure could be obtained from a flattened Kind2 native
582
582
input file with some basic static analysis by producing a dependency graph
583
583
between variables.
584
- * For now, the * Kind2* model-checker ignores these structure informations .
584
+ * For now, the * Kind2* model-checker ignores these structure information .
585
585
586
586
However, the current code offers some nice transformation tools (node merging,
587
587
` Renaming ` monad...) which could be useful if you intend to write a tool for
0 commit comments