SPARK: Formally verify an ordered set/map library in SPARK at AdaCore — Toulouse, France