H.4 High Integrity Restrictions
This clause defines restrictions that can be used
with pragma Restrictions (see 13.12
facilitate the demonstration of program correctness by allowing tailored
versions of the run-time system.
This paragraph was
The following restriction_identifier
are language defined:
There are no declarations of protected types or protected objects.
There are no occurrences of an allocator
are prohibited in subprograms, generic subprograms, tasks, and entry
Except for storage occupied by objects created by allocator
and not deallocated via unchecked deallocation, any storage reserved
at run time for an object is immediately reclaimed when the object no
are not allowed. No language-defined run-time checks are generated; however,
a run-time check performed automatically by the hardware is permitted.
Uses of predefined floating point types and operations, and declarations
of new floating point types, are not allowed.
Uses of predefined fixed point types and operations, and declarations
of new fixed point types, are not allowed.
The declaration of access-to-subprogram types is not allowed.
is not allowed.
Occurrences of T'Class are not allowed, for any (tagged) subtype T.
Semantic dependence on any of the library units Sequential_IO, Direct_IO,
Text_IO, Wide_Text_IO, Wide_Wide_Text_IO, or Stream_IO is not allowed.
and semantic dependence on package Calendar are not allowed.
As part of the execution of a subprogram, the same subprogram is not
During the execution of a subprogram by a task, no other task invokes
the same subprogram.
of this Annex shall support:
- the restrictions defined in this subclause;
- the following restrictions defined
in D.7: No_Task_Hierarchy, No_Abort_Statement,
- the pragma Profile(Ravenscar);
following uses of restriction_parameter_identifiers
defined in D.7, which are checked prior to
=> 0, and
If an implementation supports pragma
Restrictions for a particular argument, then except for the restrictions
No_Unchecked_Deallocation, No_Unchecked_Conversion, No_Access_Subprograms,
and No_Unchecked_Access, the associated restriction applies to the run-time
If a pragma Restrictions(No_Exceptions) is specified,
the implementation shall document the effects of all constructs where
language-defined checks are still performed automatically (for example,
an overflow check performed by the processor).
Program execution is erroneous
if pragma Restrictions(No_Exceptions) has been specified and the conditions
arise under which a generated language-defined run-time check would fail.
Program execution is erroneous
if pragma Restrictions(No_Recursion) has been specified and a subprogram
is invoked as part of its own execution, or if pragma Restrictions(No_Reentrancy)
has been specified and during the execution of a subprogram by a task,
another task invokes the same subprogram.
10 Uses of restriction_parameter_identifier
No_Dependence defined in 13.12.1
=> Ada.Unchecked_Deallocation and No_Dependence => Ada.Unchecked_Conversion
may be appropriate for high-integrity systems. Other uses of No_Dependence
can also be appropriate for high-integrity systems.