So why the big fuss about Design by Contract? Bertrand Meyer - - PowerPoint PPT Presentation
So why the big fuss about Design by Contract? Bertrand Meyer Software Architecture, March 2008 Verification: the vision Guardian angel approach: environment checks your software as you write it Squiggly red underscore of
2
3
4
5
6
7
8
Client Supplier
(Satisfy precondition:) Bring package before 4 p.m.; pay fee. (Satisfy postcondition:) Deliver package by 10 a.m. next day.
(From postcondition:) Get package delivered by 10 a.m. next day. (From precondition:) Not required to do anything if package delivered after 4 p.m.,
deliver
9
10
11
12
Minimum_balance: INTEGER = 1000
13
feature -- Deposit and withdrawal operations deposit (sum : INTEGER)
do add (sum) end withdraw (sum : INTEGER)
do add (– sum) end may_withdraw (sum : INTEGER): BOOLEAN
do Result := (balance - sum >= Minimum_balance) end end
14
class ACCOUNT create make feature {NONE } -- Initialization make (initial_amount: INTEGER)
require do balance := initial_amount ensure end
15
feature -- Access balance: INTEGER
Minimum_balance : INTEGER = 1000
feature {NONE} -- Implementation of deposit and withdrawal add (sum : INTEGER)
do balance := balance + sum ensure increased: balance = old balance + sum end
16
17
withdraw (sum : INTEGER)
18
Client Supplier
(Satisfy precondition:) Make sure sum is neither too small nor too big (Satisfy postcondition:) Update account for withdrawal of sum
(From postcondition:) Get account updated with sum withdrawn (From precondition:) Simpler processing: may assume sum is within allowable bounds
withdraw
19
20
may_withdraw (sum : INTEGER ): BOOLEAN
21
22
x.f (…) x.g (…) x.h (…) create x.make (…) S1
23
24
25
26
Source: OOSC
27
note description : “ 24-hour TV schedules ” deferred class SCHEDULE feature segments: LIST [SEGMENT ]
deferred end air_time : DATE is
deferred end set_air_time (t : DATE)
require t.in_future deferred ensure air_time = t end print
deferred end end
28
note description : “Fragments of a schedule " deferred class SEGMENT feature schedule : SCHEDULE deferred end
index : INTEGER deferred end
starting_time, ending_time : INTEGER deferred end
next: SEGMENT deferred end
sponsor: COMPANY deferred end
rating : INTEGER deferred end
… Commands such as change_next, set_sponsor, set_rating omitted … Minimum_duration : INTEGER = 30
Max_interval: INTEGER = 2
29
invariant in_list: (1 <= index) and (index <= schedule.segments.count) in_schedule: schedule.segments.item (index) = Current next_in_list: (next /= Void ) implies (schedule.segments.item (index + 1) = next) no_next_iff_last: (next = Void) = (index = schedule.segments.count) non_negative_rating: rating >= 0 positive_times: (starting_time > 0 ) and (ending_time > 0) sufficient_duration: ending_time – starting_time >= Minimum_duration decent_interval : (next.starting_time) - ending_time <= Max_interval end
30
note description: "Advertising segment " deferred class COMMERCIAL inherit SEGMENT rename sponsor as advertiser end feature primary: PROGRAM deferred
primary_index: INTEGER deferred
set_primary (p : PROGRAM)
require program_exists: p /= Void same_schedule: p,schedule = schedule before: p.starting_time <= starting_time deferred ensure index_updated: primary_index = p.index primary_updated: primary = p end invariant meaningful_primary_index: primary_index = primary.index primary_before: primary.starting_time <= starting_time acceptable_sponsor: advertizer.compatible (primary.sponsor) acceptable_rating: rating <= primary.rating end
31
32
33
34
r require
ensure
r require
ensure
a1: A a1.r (…) …
r ++
C A D B
Client Inheritance
++ Redefinition
35
36
A simple language rule does the trick! Redefined version may have nothing (assertions kept by default),
require else new_pre ensure then new_post Resulting assertions are:
37
38
39
40
41
42
YOUR APPLICATION COMPONENT LIBRARY
your_list.insert (y, a + b + 1) i <= count + 1 insert (x : G ; i : INTEGER) require i >= 0 class LIST [G ] feature
43
44
45
46
class interface ACCOUNT create make feature balance: INTEGER
Minimum_balance : INTEGER = 1000
deposit (sum: INTEGER)
require not_too_small: sum >= 0 ensure increased: balance = old balance + sum
47
withdraw (sum: INTEGER)
require not_too_small: sum >= 0 not_too_big: sum <= balance – Minimum_balance ensure decreased: balance = old balance – sum
may_withdraw (sum: INTEGER): BOOLEAN
invariant not_under_minimum: balance >= Minimum_balance consistent: balance = deposits.total – withdrawals.total end
48
49
50
50
class BANK_ACCOUNT create make feature make (n : STRING)
name := n balance := 0
name : STRING balance : INTEGER deposit ( v : INTEGER)
do balance := balance + v ensure balance = old balance + v end invariant name /= Void balance >= 0 end ensure name = n require n /= Void ensure balance = old balance + v invariant name /= Void balance >= 0
51
51
52
53
53
54
54
55
56
56
57
57
58
58
create {STRING} v1 v1.wipe_out v1.append_character (’c’) v1.append_double (2.45) create {STRING} v2 v1.append_string (v2) v2.fill (’g’, 254343) ... create {BANK_ACCOUNT} v3.make (v2) v3.deposit (15) v3.deposit (100) v3.deposit (-8901) ...
class BANK_ACCOUNT create make feature make (n : STRING) require n /= Void do name := n balance := 0 ensure name = n end name : STRING balance : INTEGER deposit (v : INTEGER) do balance := balance + v ensure balance =
end invariant name /= Void balance >= 0 end
59
60
60
61
61
(constructors)
62
# bugs Class STRING
Timeout (minutes)
63
63
64
64
p ↔ q combination ( type_distance (p.type, q.type), field_distance (p, q), recursive_distance ( {[p.r ↔ q.r] | r ∈ Reference_attributes } )
Δ
65
66
67
“Zurich" Cursor index count 1 after before is_first is_last
68
69
Class Random Boolean Queries Routine Coverage Bugs Found Routine Coverage Bugs Found INT_STACK 33% 1 100% 2 LINKED_LIST 85% 1 99% 7 BINARY_TREE 88% 5 100% 11 ARRAYED_SET 84% 1 100% 6 FIXED_LIST 93% 12 99% 12
70
71
72
73
74
75
75
76
77
class SEQUENCE [G] feature count : NATURAL
last : G
extended (x) : SEQUENCE [G]
ensure Result.count = count + 1 Result.last = x Result.sub (1, count ) ~ Current mirrored : SEQUENCE [G]
ensure Result.count = count … … end
78
class LINKED_LIST [G] feature … remove_front
require not empty do first := first.right ensure end … end
first right right right
count = old count – 1 first = old item (2) model = old model.tail
79
80