Design by Contract

1. Design by Contract 契约式设计 Institute of Computer Software Nanjing University

2. 摘要 • 引言 • Eiffel 的 DbC 机制 • DbC与继承 • 如何应用DbC Institute of Computer Software Nanjing University

3. 引言 • Design by Contract (DbC) 契约式设计 • 方法学层面的思想 • 以尽可能小的代价开发出可靠性出众的软件系统 • Eiffel语言的直接支持 • Bertrand Meyer：DbC是构建面向对象软件系统方法的核心！ • James McKim：“只要你会写程序，你就会写契约” Institute of Computer Software Nanjing University

4. 引言 • A discipline of analysis, design, implementation, management （可以贯穿于软件创建的全过程，从分析到设计，从文档到调试，甚至可以渗透到项目管理中） • Viewing the relationship between a class and its clients as a formal agreement, expressing each party’s rights and obligations. （把类和它的客户程序之间的关系看做正式的协议，描述双方的权利和义务） Institute of Computer Software Nanjing University

5. 引言 • Every software element is intended to satisfy a certain goal, for the benefit of other software elements (and ultimately of human users). • This goal is the element’s contract. • The contract of any software element should be • Explicit. • Part of the software element itself. Institute of Computer Software Nanjing University

6. A human contract OBLIGATIONS(义务) BENEFITS(权益/权利) deliver (Satisfy precondition:) Bring package before 4 p.m.; pay fee. (From postcondition:) Get package delivered by 10 a.m. next day. Client (Satisfy postcondition:) Deliver package by 10 a.m. next day. (From precondition:) Not required to do anything if package delivered after 4 p.m., or fee not paid. Supplier Institute of Computer Software Nanjing University

7. A view of software construction • Constructing systems as structured collections of cooperating software elements — suppliers and clients — cooperating on the basis of clear definitions of obligations and benefits. • These definitions are the contracts. Institute of Computer Software Nanjing University

8. Properties of contracts • A contract: • Binds two parties (or more): supplier, client. • Is explicit (written). • Specifies mutual obligations and benefits. • Usually maps obligation for one of the parties into benefit for the other, and conversely. • Has no hidden clauses: obligations are those specified. • Often relies, implicitly or explicitly, on general rules applicable to all contracts (laws, regulations, standard practices). Institute of Computer Software Nanjing University

9. deferred classPLANEinherit AIRCRAFT feature start_take_offis-- Initiate take-off procedures. requirecontrols.passed assigned_runway.clear deferredensureassigned_runway.owner =Current moving end start_landing, increase_altitude, decrease_altitude, moving, altitude, speed, time_since_take_off ... [Other features] ... invariant (time_since_take_off <= 20) implies(assigned_runway.owner = Current) moving = (speed > 10) end Contracts for analysis Precondition -- i.e. specified only. -- not implemented. Postcondition Class invariant Institute of Computer Software Nanjing University

10. deferred classVATinheritTANK featurein_valve, out_valve: VALVE fillis-- Fill the vat. requirein_valve.open out_valve.closed deferredensurein_valve.closed out_valve.closed is_full end empty, is_full, is_empty, gauge, maximum, ... [Other features] ... invariant is_full = (gauge >= 0.97 * maximum)  and(gauge <= 1.03 * maximum) end Contracts for analysis (cont’d) Precondition -- i.e. specified only. -- not implemented. Postcondition Class invariant Institute of Computer Software Nanjing University

11. Contracts for analysis (cont’d) OBLIGATIONS BENEFITS fill (Satisfy precondition:) Make sure input valve is open, output valve is closed. (From postcondition:) Get filled-up vat, with both valves closed. Client (Satisfy postcondition:) Fill the vat and close both valves. (From precondition:) Simpler processing thanks to assumption that valves are in the proper initial position. Supplier Institute of Computer Software Nanjing University

12. So, is it like “assert.h”? (Source: Reto Kramer) • Design by Contract goes further: • “Assert” does not provide a contract. • Clients cannot see asserts as part of the interface. • Asserts do not have associated semantic specifications. • Not explicit whether an assert represents a precondition, post-conditions or invariant. • Asserts do not support inheritance. • Asserts do not yield automatic documentation. Institute of Computer Software Nanjing University

13. Contracts • 契约就是“规范和检查”！ • Precondition：针对method，它规定了在调用该方法之前必须为真的条件 • Postcondition：针对method，它规定了方法顺利执行完毕之后必须为真的条件 • Invariant：针对整个类，它规定了该类任何实例调用任何方法都必须为真的条件 Institute of Computer Software Nanjing University

14. Correctness in software • Correctness is a relative notion: consistency of implementation vis-a-vis specification. (This assumes there is a specification!) • Basic notation: (P, Q: assertions, i.e. properties of the state of the computation. A: instructions). {P} A {Q} • “Hoare triple” • What this means (total correctness): • Any execution of A started in a state satisfying P will terminate in a state satisfying Q. Institute of Computer Software Nanjing University

15. Hoare triples: a simple example {n > 5}n := n + 9 {n > 13} • Most interesting properties: • Strongest postcondition (from given precondition). • Weakest precondition (from given postcondition). • “P is stronger than or equal to Q” means: P implies Q • QUIZ: What is the strongest possible assertion? The weakest? Institute of Computer Software Nanjing University

16. Software correctness “We are looking for someone whose work will be to start from initial situations as characterized by P, and deliver results as defined by Q • Consider {P} A {Q} • Take this as a job ad in the classifieds. • Should a lazy employment candidate hope for a weak or strong P?What about Q? • Two special offers: • 1. {False}A{...} • 2. {...}A{True} Strongest precond. Weakest postcond. Institute of Computer Software Nanjing University

17. 摘要 • 引言 • Eiffel 的 DbC 机制 • DbC与继承 • 如何应用DbC Institute of Computer Software Nanjing University

18. Design by Contract: The Mechanism • Preconditions and Postconditions • Class Invariant • Run-time effect Institute of Computer Software Nanjing University

19. extend (new: G; key: H) -- Assuming there is no item of key key, -- insert new with key; set inserted. require key_not_present: nothas (key) ensure insertion_done: item (key) = new key_present: has (key) inserted: inserted one_more: count = oldcount + 1 A contract (from EiffelBase) Institute of Computer Software Nanjing University

20. The contract OBLIGATIONS BENEFITS Routine Client PRECONDITION POSTCONDITION Supplier POSTCONDITION PRECONDITION Institute of Computer Software Nanjing University

21. A class without contracts classACCOUNTfeature-- Access balance: INTEGER-- Balance Minimum_balance: INTEGERis 1000 -- Minimum balance feature {NONE} -- Implementation of deposit and withdrawaladd (sum: INTEGER) is-- Add sum to the balance (secret procedure).dobalance := balance + sumend Institute of Computer Software Nanjing University

22. feature-- Deposit and withdrawal operations deposit (sum: INTEGER) is-- Deposit sum into the account.doadd (sum)endwithdraw (sum: INTEGER) is-- Withdraw sum from the account.doadd (–sum)end may_withdraw (sum: INTEGER): BOOLEANis-- Is it permitted to withdraw sum from the account?doResult := (balance - sum >= Minimum_balance)end end Without contracts (cont’d) Institute of Computer Software Nanjing University

23. Introducing contracts classACCOUNTcreate make feature {NONE} -- Initialization make (initial_amount: INTEGER) is-- Set up account with initial_amount. requirelarge_enough: initial_amount >= Minimum_balance dobalance := initial_amount ensurebalance_set: balance = initial_amount end Institute of Computer Software Nanjing University

24. feature -- Access balance: INTEGER-- Balance Minimum_balance: INTEGERis 1000 -- Minimum balance feature {NONE} -- Implementation of deposit and withdrawaladd (sum: INTEGER) is-- Add sum to the balance (secret procedure).dobalance := balance + sum ensure increased: balance = oldbalance + sum end Introducing contracts (cont’d) Institute of Computer Software Nanjing University

25. feature-- Deposit and withdrawal operations deposit (sum: INTEGER) is-- Deposit sum into the account. require not_too_small: sum >= 0 doadd (sum)ensure increased: balance = oldbalance + sum end With contracts (cont’d) Institute of Computer Software Nanjing University

26. With contracts (cont’d) withdraw (sum: INTEGER) is-- Withdraw sum from the account.require not_too_small: sum >= 0 not_too_big: sum <= balance – Minimum_balance doadd (– sum) -- i.e. balance := balance – sum ensure decreased: balance = oldbalance - sum end Institute of Computer Software Nanjing University

27. The contract OBLIGATIONS BENEFITS withdraw (Satisfy precondition:) Make sure sum is neither too small nor too big. (From postcondition:) Get account updated with sum withdrawn. Client (Satisfy postcondition:) Update account for withdrawal of sum. (From precondition:) Simpler processing: may assume sum is within allowable bounds. Supplier Institute of Computer Software Nanjing University

28. The imperative and the applicative do balance:=balance - sum ensure balance=oldbalance - sum PRESCRIPTIVE DESCRIPTIVE How? What? Operational Denotational Implementation Specification Command Query Instruction Expression Imperative Applicative Institute of Computer Software Nanjing University

29. With contracts (end) may_withdraw (sum: INTEGER): BOOLEANis-- Is it permitted to withdraw sum from the -- account? doResult := (balance - sum >= Minimum_balance)end invariant not_under_minimum: balance >= Minimum_balance end Institute of Computer Software Nanjing University

30. The class invariant • Consistency constraint applicable to all instances of a class. • Must be satisfied: • After creation. • After execution of any feature by any client.(Qualified calls only: a.f (...)) Institute of Computer Software Nanjing University

31. createa.make (…) S1 a.f (…) S2 a.g (…) S3 a.f (…) S4 The correctness of a class • For every creation procedure cp: {precp} docp {postcp and INV} • For every exported routine r: {INV and prer} dor {postr and INV} • The worst possible erroneous run-time situation in object-oriented software development: • Producing an object that does not satisfy the invariant of its own class. Institute of Computer Software Nanjing University

32. Example balance = deposits.total–withdrawals.total deposits (A1) withdrawals deposits (A2) withdrawals balance Institute of Computer Software Nanjing University

33. classACCOUNTcreate make feature {NONE} -- Implementation add (sum: INTEGER) is-- Add sum to the balance (secret procedure).dobalance := balance + sumensure balance_increased: balance = oldbalance + sum end deposits: DEPOSIT_LIST withdrawals: WITHDRAWAL_LIST A more sophisticated version Institute of Computer Software Nanjing University

34. New version (cont’d) feature {NONE} -- Initialization make (initial_amount: INTEGER) is-- Set up account with initial_amount.requirelarge_enough: initial_amount >= Minimum_balancedobalance := initial_amount createdeposits.makecreatewithdrawals.make ensurebalance_set: balance = initial_amount end feature -- Accessbalance: INTEGER-- Balance Minimum_balance: INTEGERis 1000 -- Minimum balance

35. New version (cont’d) feature-- Deposit and withdrawal operations deposit (sum: INTEGER) is-- Deposit sum into the account. require not_too_small: sum >= 0 doadd (sum) deposits.extend (create {DEPOSIT}.make (sum))ensure increased: balance = oldbalance + sum end Institute of Computer Software Nanjing University

36. withdraw (sum: INTEGER) is-- Withdraw sum from the account.require not_too_small: sum >= 0 not_too_big: sum <= balance – Minimum_balance doadd (–sum) withdrawals.extend (create {WITHDRAWAL}.make (sum)) ensure decreased: balance = oldbalance – sum one_more: withdrawals.count = oldwithdrawals.count + 1 end New version (cont’d) Institute of Computer Software Nanjing University

37. may_withdraw (sum: INTEGER): BOOLEANis-- Is it permitted to withdraw sum from the -- account? doResult := (balance - sum >= Minimum_balance)end invariant not_under_minimum: balance >= Minimum_balance consistent: balance = deposits.total – withdrawals.total end New version (end) Institute of Computer Software Nanjing University

38. The correctness of a class createa.make (…) S1 • For every creation procedure cp: {precp} docp {postcp and INV} • For every exported routine r: {INV and prer} dor {postr and INV} a.f (…) S2 a.g (…) S3 a.f (…) S4 Institute of Computer Software Nanjing University

39. feature {NONE} -- Initialization make (initial_amount: INTEGER) is-- Set up account with initial_amount.requirelarge_enough: initial_amount >= Minimum_balancedo balance := initial_amount createdeposits.makecreatewithdrawals.make ensurebalance_set: balance = initial_amount end Initial version Institute of Computer Software Nanjing University

40. feature {NONE} -- Initialization make (initial_amount: INTEGER) is-- Set up account with initial_amount.requirelarge_enough: initial_amount >= Minimum_balancedo createdeposits.makecreatewithdrawals.make deposit (initial_amount) ensurebalance_set: balance = initial_amount end Correct version 40 Institute of Computer Software Nanjing University

41. Contracts: run-time effect 41 • Compilation options (per class, in Eiffel): • No assertion checking • Preconditions only • Preconditions and postconditions • Preconditions, postconditions, class invariants • All assertions Institute of Computer Software Nanjing University

42. 摘要 • 引言 • Eiffel 的 DbC 机制 • DbC与继承 • 如何应用DbC Institute of Computer Software Nanjing University

43. 继承与 Design by Contract • 问题： • 子类中的断言与父类中的断言是什么关系？ • 依据 • 子类乃父类的特化，子类的实例也是父类的合法实例。 • 申明为父类的引用运行时可能指向子类实例 • 因而 • ？ Institute of Computer Software Nanjing University

44. Inheritance and assertions Correct call: ifa1.then a1.r (...) else ... end ris C A a1: A  … ensure a1.r (…)  B ris  ensure  Institute of Computer Software Nanjing University

45. Contract OBLIGATIONS BENEFITS delivery (Satisfy precondition:) 不得要求投递超过5kg的包裹 (From postcondition:) 3个工作日内包裹到位 Client (Satisfy postcondition:) 在3个工作日内投送到位 (From precondition:) 不受理超过5kg的包裹 Supplier Institute of Computer Software Nanjing University

46. Contract class COURIER feature deliver(p:Package, d:Destination) require --包裹重量不超过5kg ensure --3个工作日内投送到指定地点 … end Institute of Computer Software Nanjing University

47. More desirable contract OBLIGATIONS BENEFITS delivery (Satisfy precondition:) 不得要求投递超过8kg的包裹 (From postcondition:) 2个工作日内包裹到位 Client (Satisfy postcondition:) 在2个工作日内投送到位 (From precondition:) 不受理超过8kg的包裹 Supplier Institute of Computer Software Nanjing University

48. More desirable contract class DIFFERENT_COURIER Inherit COURIER redefine deliver feature deliver(p:Package, d:Destination) require --包裹重量不超过5kg require else --包裹重量不超过8kg ensure --3天内投送到指定地点 ensure then --2天内投送到指定地点 … end require --包裹重量不超过8kg ensure -- 2天内投送到指定地点 Institute of Computer Software Nanjing University

49. Assertion redeclaration rule • Redefined version may not have require or ensure. • May have nothing (assertions kept by default), or require elsenew_pre ensure thennew_post • Resulting assertions are: • original_preconditionornew_pre • original_postconditionandnew_post Institute of Computer Software Nanjing University

50. Invariant accumulation • Every class inherits all the invariant clauses of its parents. • These clauses are conceptually “and”-ed. Institute of Computer Software Nanjing University