DOCSLIB.ORG

Design Contract™

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Design Contract™ Design by Contract™ 1 Design by Contract Software Engineering Design by Contract Every software element is intended to satisfy a certain goal, for the benefit of other software elements (and ultimately of human users). This goal is the element’s contract. The contract of any software element should be ¾ Explicit. ¾ Part of the software element itself. 2 Design by Contract Software Engineering Design by Contract: applications ¾ Built-in correctness ¾ Automatic documentation ¾ Self-debugging, self-testing code ¾ Get inheritance right ¾ Get exceptions right ¾ Give managers better control tools 3 Design by Contract Software Engineering 1 Software construction: the underlying view Constructing systems as structured collections of cooperating software elements — suppliers and clients — cooperating on the basis of clear definitions of obligations and benefits These definitions are the contracts 4 Design by Contract Software Engineering Properties of contracts A contract: ¾ Binds two parties (or more): supplier, client ¾ Is explicit (written) ¾ Specifies mutual obligations and benefits ¾ Usually maps obligation for one of the parties into benefit for the other, and conversely ¾ Has no hidden clauses: obligations are those specified ¾ Often relies, implicitly or explicitly, on general rules applicable to all contracts (laws, regulations, standard practices) 5 Design by Contract Software Engineering A human contract deliver OBLIGATIONS BENEFITS (Satisfy precondition:) (From postcondition:) Client Bring package before Get package delivered 4 p.m.; pay fee. by 10 a.m. next day. (Satisfy postcondition:) (From precondition:) Supplier Deliver package by Not required to do 10 a.m. next day. anything if package delivered after 4 p.m., or fee not paid. 6 Design by Contract Software Engineering 2 EiffelStudio documentation Produced automatically from class text Available in text, HTML, Postscript, RTF, FrameMaker and many other formats Numerous views, textual and graphical 7 Design by Contract Software Engineering Contracts for documentation Demo LINKED_LIST Documentation, generated by EiffelStudio 8 Design by Contract Software Engineering Contract form: Definition Simplified form of class text, retaining interface elements only: ¾ Remove any non-exported (private) feature. For the exported (public) features: ¾ Remove body (do clause). ¾ Keep header comment if present. ¾ Keep contracts: preconditions, postconditions, class invariant. ¾ Remove any contract clause that refers to a secret feature. (What’s the problem?) 9 Design by Contract Software Engineering 3 The different forms of a class All features and contract Only the exported (non secret) clauses elements Elements from the class only Text view: Contract view: text form short form Elements from the class and Flat view: Interface view: it’s ancestors flat form flat short form 10 Design by Contract Software Engineering Export rule for preconditions In feature {A, B, C} r (…) is require some_property some_property must be exported (at least) to A, B and C! No such requirement for postconditions and invariants. 11 Design by Contract Software Engineering Contracts for analysis, specification deferred class VAT inherit TANK feature in_valve, out_valve: VALVE fill is -- Fill the vat. require in_valve.open out_valve.closed deferred ensure in_valve.closed out_valve.closed is_full end empty, is_full, is_empty, gauge, maximum, ... [Other features] ... invariant is_full = (gauge >= 0.97 ∗ maximum) and (gauge <= 1.03 ∗ maximum) end Chair of Software Engineering 4 Contracts for testing and debugging ¾ Contracts express implicit assumptions behind code ¾ A bug is a discrepancy between intent and code ¾ Contracts state the intent! In EiffelStudio: select compilation option for run-time contract monitoring at level of: ¾ Class ¾ Cluster ¾ System May disable monitoring when releasing software A revolutionary form of quality assurance 13 Design by Contract Software Engineering Lists in EiffelBase before after item “Iowa" 1 count Cursor back forth start finish index 14 Design by Contract Software Engineering Trying to insert too far right after "Iowa" 1 count Cursor (Already past last element!) 15 Design by Contract Software Engineering 5 A command and its contract Precondition Postcondition 16 Design by Contract Software Engineering Moving the cursor forward before after "Iowa" 1 count Cursor forth index 17 Design by Contract Software Engineering Two queries, and command “forth″ 18 Design by Contract Software Engineering 6 Where the cursor may go before after item 0 1 count count+1 Valid cursor positions 19 Design by Contract Software Engineering From the invariant of class LIST Valid cursor positions 20 Design by Contract Software Engineering Contract monitoring A contract violation always signals a bug: ¾ Precondition violation: bug in client ¾ Postcondition violation: bug in routine 21 Design by Contract Software Engineering 7 Contracts and inheritance Issues: what happens, under inheritance, to ¾ Class invariants? ¾ Routine preconditions and postconditions? 22 Design by Contract Software Engineering Invariants Invariant Inheritance rule: ¾ The invariant of a class automatically includes the invariant clauses from all its parents, “and”-ed. Accumulated result visible in flat and interface forms. 23 Design by Contract Software Engineering Contracts and inheritance A r is C require a1: A … α a1.r (…) ensure β Correct call in C: if a1.α then r ++ a1.r (...) D B r is -- Here a1.β hold require end γ ensure Client ++ Redefinition Inheritance δ 24 Design by Contract Software Engineering 8 Assertion redeclaration rule When redeclaring a routine, we may only: ¾ Keep or weaken the precondition ¾ Keep or strengthen the postcondition 25 Design by Contract Software Engineering Assertion redeclaration rule in Eiffel A simple language rule does the trick! Redefined version may have nothing (assertions kept by default), or require else new_pre ensure then new_post Resulting assertions are: ¾ original_precondition or new_pre ¾ original_postcondition and new_post 26 Design by Contract Software Engineering Contracts as a management tool High-level view of modules for the manager: ¾ Follow what’s going on without reading the code ¾ Enforce strict rules of cooperation between units of the system ¾ Control outsourcing 27 Design by Contract Software Engineering 9 Checking input: filter modules Contracts are not input checking tests... ... but they can help weed out undesirable input External Input & objects validation Processing modules modules Postconditions ⇒ Preconditions No preconditions! here only 28 Design by Contract Software Engineering Precondition design The client must guarantee the precondition before the call. This does not necessarily mean testing for the precondition. Scheme 1 (testing): if not my_stack.is_full then my_stack.put (some_element) end Scheme 2 (guaranteeing without testing): my_stack.remove ... my_stack.put (some_element) 29 Design by Contract Software Engineering Another example sqrt (x, epsilon: REAL): REAL is -- Square root of x, precision epsilon require x >= 0 epsilon >= 0 do ... ensure abs (Result ^ 2 – x) <= 2 * epsilon * Result end 30 Design by Contract Software Engineering 10 The contract sqrt OBLIGATIONS BENEFITS (Satisfy precondition:) (From postcondition:) Client Provide non-negative Get square root within value and precision requested precision. that is not too small. (Satisfy postcondition:) (From precondition:) Supplier Produce square root Simpler processing within requested thanks to assumptions precision. on value and precision. 31 Design by Contract Software Engineering Not defensive programming It is not acceptable to have a routine of the form sqrt (x, epsilon: REAL): REAL is -- Square root of x, precision epsilon require x >= 0 epsilon >= 0 do if x < 0 then … Do something about it (?) … else … normal square root computation … end ensure abs (Result ^ 2 – x) <= 2 * epsilon * Result end 32 Design by Contract Software Engineering Not defensive programming For every consistency condition that is required to perform a certain operation: ¾ Assign responsibility for the condition to one of the contract’s two parties (supplier, client). ¾ Stick to this decision: do not duplicate responsibility. Simplifies software and improves global reliability. 33 Design by Contract Software Engineering 11 Interpreters class BYTECODE_PROGRAM feature verified: BOOLEAN trustful_execute (program: BYTECODE) is require ok: verified do ... end distrustful_execute (program: BYTECODE) is do verify if verified then trustful_execute (program) end end verify is do ... end end 34 Design by Contract Software Engineering How strong should a precondition be? Two opposite styles: ¾ Tolerant: weak preconditions (including the weakest, True: no precondition). ¾ Demanding: strong preconditions, requiring the client to make sure all logically necessary conditions are satisfied before each call. Partly a matter of taste. But: demanding style leads to a better distribution of roles, provided the precondition is: ¾ Justifiable in terms of the specification only. ¾ Documented (through the short form). ¾ Reasonable! 35 Design by Contract Software Engineering A demanding style sqrt (x, epsilon: REAL): REAL is -- Square root of x, precision epsilon -- Same version as before require x >= 0 epsilon >= 0 do ... ensure abs (Result ^ 2 – x) <= 2 * epsilon * Result end 36 Design by Contract Software Engineering 12 A tolerant style sqrt (x, epsilon: REAL): REAL is NO INPUT -- Square root of x, precision epsilon TOO BIG OR require
Load more

Recommended publications
  • Génération Automatique De Tests Unitaires Avec Praspel, Un Langage De Spécification Pour PHP the Art of Contract-Based Testing in PHP with Praspel
    CORE Metadata, citation and similar papers at core.ac.uk Provided by HAL - Université de Franche-Comté G´en´erationautomatique de tests unitaires avec Praspel, un langage de sp´ecificationpour PHP Ivan Enderlin To cite this version: Ivan Enderlin. G´en´eration automatique de tests unitaires avec Praspel, un langage de sp´ecificationpour PHP. Informatique et langage [cs.CL]. Universit´ede Franche-Comt´e,2014. Fran¸cais. <NNT : 2014BESA2067>. <tel-01093355v2> HAL Id: tel-01093355 https://hal.inria.fr/tel-01093355v2 Submitted on 19 Oct 2016 HAL is a multi-disciplinary open access L'archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destin´eeau d´ep^otet `ala diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publi´esou non, lished or not. The documents may come from ´emanant des ´etablissements d'enseignement et de teaching and research institutions in France or recherche fran¸caisou ´etrangers,des laboratoires abroad, or from public or private research centers. publics ou priv´es. Thèse de Doctorat école doctorale sciences pour l’ingénieur et microtechniques UNIVERSITÉ DE FRANCHE-COMTÉ No X X X THÈSE présentée par Ivan Enderlin pour obtenir le Grade de Docteur de l’Université de Franche-Comté K 8 k Génération automatique de tests unitaires avec Praspel, un langage de spécification pour PHP The Art of Contract-based Testing in PHP with Praspel Spécialité Informatique Instituts Femto-ST (département DISC) et INRIA (laboratoire LORIA) Soutenue publiquement
    [Show full text]
  • Chapter 23 Three Design Principles
    23 Three Design Principles Chapter 23 ContaxT / Kodax Tri-X Nunnery — Chichen Itza, Mexico Three Design Principles Learning Objectives • List the preferred characteristics of an object-oriented application architecture • State the definition of the Liskov Substitution Principle (LSP) • State the definition of Bertrand Meyer's Design by Contract (DbC) programming • Describe the close relationship between the Liskov Substitution Principle and Design by Contract • State the purpose of class invariants • State the purpose of method preconditions and postconditions • Describe the effects weakening and strengthening preconditions have on subclass behavior • Describe the effects weakening and strengthening postconditions have on subclass behavior • State the purpose and use of the Open-Closed Principle (OCP) • State the purpose and use of the Dependency Inversion Principle (DIP) • State the purpose of Code Contracts and how they are used to enforce preconditions, postconditions, and class invariants C# For Artists © 2015 Rick Miller and Pulp Free Press — All Rights Reserved 757 Introduction Chapter 23: Three Design Principles Introduction Building complex, well-behaved, object-oriented software is a difficult task for several reasons. First, simply programming in C# does not automatically make your application object-oriented. Second, the pro- cess by which you become proficient at object-oriented design and programming is characterized by expe- rience. It takes a lot of time to learn the lessons of bad software architecture design and apply those lessons learned to create good object-oriented architectures. The objective of this chapter is to help you jump-start your object-oriented architectural design efforts. I begin with a discussion of the preferred characteristics of a well-designed object-oriented architecture.
    [Show full text]
  • Grammar-Based Testing Using Realistic Domains in PHP Ivan Enderlin, Frédéric Dadeau, Alain Giorgetti, Fabrice Bouquet
    Grammar-Based Testing using Realistic Domains in PHP Ivan Enderlin, Frédéric Dadeau, Alain Giorgetti, Fabrice Bouquet To cite this version: Ivan Enderlin, Frédéric Dadeau, Alain Giorgetti, Fabrice Bouquet. Grammar-Based Testing using Realistic Domains in PHP. A-MOST 2012, 8th Workshop on Advances in Model Based Testing, joint to the ICST’12 IEEE Int. Conf. on Software Testing, Verification and Validation, Jan 2012, Canada. pp.509–518. hal-00931662 HAL Id: hal-00931662 https://hal.archives-ouvertes.fr/hal-00931662 Submitted on 16 Jan 2014 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Grammar-Based Testing using Realistic Domains in PHP Ivan Enderlin, Fred´ eric´ Dadeau, Alain Giorgetti and Fabrice Bouquet Institut FEMTO-ST UMR CNRS 6174 - University of Franche-Comte´ - INRIA CASSIS Project 16 route de Gray - 25030 Besanc¸on cedex, France Email: fivan.enderlin,frederic.dadeau,alain.giorgetti,[email protected] Abstract—This paper presents an integration of grammar- Contract-based testing [5] has been introduced in part to based testing in a framework for contract-based testing in PHP. address these limitations. It is based on the notion of Design It relies on the notion of realistic domains, that make it possible by Contract (DbC) [6] introduced by Meyer with Eiffel [7].
    [Show full text]
  • 3. Design by Contract
    3. Design by Contract Oscar Nierstrasz Design by Contract Bertrand Meyer, Touch of Class — Learning to Program Well with Objects and Contracts, Springer, 2009. 2 Bertrand Meyer is a French computer scientist who was a Professor at ETH Zürich (successor of Niklaus Wirth) from 2001-2015. He is best known as the inventor of “Design by Contract”, and as the designer of the Eiffel programming language, which provides built-in for DbC. DbC was first described in a technical report by Meyer in 1986: https://en.wikipedia.org/wiki/Design_by_contract Who’s to blame? The components fit but the system does not work. Who’s to blame? The component developer or the system integrator? 3 DbC makes clear the “contract” between a supplier (an object or “component”) and its client. When something goes wrong, the contract states whose fault it is. This simplifies both design and debugging. Why DbC? > Design by Contract —documents assumptions (what do objects expect?) —simplifies code (no special actions for failure) —aids debugging (identifies who’s to blame) 4 As we shall see, DbC improves your OO design in several ways. First, contracts make explicit the assumptions under which an object (supplier) will work correctly. Second, they simplify your code, since no special action is required when things go wrong — the exception handling framework provides the necessary tools. Third, contracts help in debugging since errors are caught earlier, when contracts are violated, not when your program crashes because of an invalid state, and it is clear where to lay the blame for the violation (i.e., in the object or its client).
    [Show full text]
  • You Say 'JML' ? Wikipedia (En)
    You say 'JML' ? Wikipedia (en) PDF generated using the open source mwlib toolkit. See http://code.pediapress.com/ for more information. PDF generated at: Mon, 06 Jan 2014 09:58:42 UTC Contents Articles Java Modeling Language 1 Design by contract 5 Formal methods 10 References Article Sources and Contributors 15 Image Sources, Licenses and Contributors 16 Article Licenses License 17 Java Modeling Language 1 Java Modeling Language The Java Modeling Language (JML) is a specification language for Java programs, using Hoare style pre- and postconditions and invariants, that follows the design by contract paradigm. Specifications are written as Java annotation comments to the source files, which hence can be compiled with any Java compiler. Various verification tools, such as a runtime assertion checker and the Extended Static Checker (ESC/Java) aid development. Overview JML is a behavioural interface specification language for Java modules. JML provides semantics to formally describe the behavior of a Java module, preventing ambiguity with regard to the module designers' intentions. JML inherits ideas from Eiffel, Larch and the Refinement Calculus, with the goal of providing rigorous formal semantics while still being accessible to any Java programmer. Various tools are available that make use of JML's behavioral specifications. Because specifications can be written as annotations in Java program files, or stored in separate specification files, Java modules with JML specifications can be compiled unchanged with any Java compiler. Syntax JML specifications are added to Java code in the form of annotations in comments. Java comments are interpreted as JML annotations when they begin with an @ sign.
    [Show full text]
  • Program Correctness
    12 Program Correctness “Testing can show the presence of errors, but not their absence.” E. W. Dijkstra CHAPTER OUTLINE 12.1 WHY CORRECTNESS? 00 12.2 *REVIEW OF LOGIC AND PROOF 00 12.2.1 Inference Rules and Direct Proof 00 12.2.2 Induction Proof 00 12.3 AXIOMATIC SEMANTICS OF IMPERATIVE PROGRAMS 00 12.3.1 Inference Rules for State Transformations 00 12.3.2 Correctness of Programs with Loops 00 12.3.3 Perspectives on Formal Methods 00 12.3.4 Formal Methods Tools: JML 00 12.4 CORRECTNESS OF OBJECT-ORIENTED PROGRAMS 00 12.4.1 Design by Contract 00 12.4.2 The Class Invariant 00 12.4.3 Example: Correctness of a Stack Application1 00 12.5 CORRECTNESS OF FUNCTIONAL PROGRAMS 00 12.5.1 Recursion and Induction 00 12.5.2 Examples of Structural Induction 00 12.1 WHY CORRECTNESS? Programming languages are powerful vehicles for designing and implementing complex software. Complex software systems are difficult to design well, and often the resulting system is full of errors. Much has been written about the need for better methodologies and tools for designing reliable software, and in recent years some of these tools have begun to show some promise. 1 2 12. PROGRAM CORRECTNESS It is appropriate in our study of modern programming languages to examine the question of language features that support the design of reliable software systems and how those features extend the expressive power of conventional languages. This chapter thus addresses the issue of program correctness from the important perspective of language features and programming paradigms.
    [Show full text]
  • Eiffelstudio: a Guided Tour
    EiffelStudio: A Guided Tour Interactive Software Engineering 2 EIFFELSTUDIO: A GUIDED TOUR § Manual identification Title: EiffelStudio: A Guided Tour, ISE Technical Report TR-EI-68/GT. (Replaces TR-EI-38/EB.) Publication history First published 1993 as First Steps with EiffelBench (TR-EI-38/EB) and revised as a chapter of Eiffel: The Environment (TR-EI- 39/IE), also available as An Object-Oriented Environment (Prentice Hall, 1994, ISBN 0-13-245-507-2. Version 3.3.8, 1995. Version 4.1, 1997 This version: July 2001. Corresponds to release 5.0 of the ISE Eiffel environment. Author Bertrand Meyer. Software credits Emmanuel Stapf, Arnaud Pichery, Xavier Rousselot, Raphael Simon; Étienne Amodeo, Jérôme Bou Aziz, Vincent Brendel, Gauthier Brillaud, Paul Colin de Verdière, Jocelyn Fiat, Pascal Freund, Savrak Sar, Patrick Schönbach, Zoran Simic, Jacques Sireude, Tanit Talbi, Emmanuel Texier, Guillaume Wong-So; EiffelVision 2: Leila Ait-Kaci, Sylvain Baron, Sami Kallio, Ian King, Sam O’Connor, Julian Rogers. See also acknowledgments for earlier versions in Eiffel: The Environment (TR-EI-39/IE) Non-ISE: special thanks to Thomas Beale, Éric Bezault, Paul Cohen, Paul-Georges Crismer, Michael Gacsaly, Dave Hollenberg, Mark Howard, Randy John, Eirik Mangseth, Glenn Maughan, Jacques Silberstein. Cover design Rich Ayling. Copyright notice and proprietary information Copyright © Interactive Software Engineering Inc. (ISE), 2001. May not be reproduced in any form (including electronic storage) without the written permission of ISE. “Eiffel Power” and the Eiffel Power logo are trademarks of ISE. All uses of the product documented here are subject to the terms and conditions of the ISE Eiffel user license.
    [Show full text]
  • Principles of Library Design: the Eiffel Experience “Plan”
    Principles of Library Design: The Eiffel Experience Bertrand Meyer ADFOCS Summer School, 2003 LECTURE 2 1 “Plan” z 1: Intro to Eiffel and Principles of library design z 2: Design by Contract z 3: Trusted Components z 4: Towards proofs 2 1 Designing for consistency: An example z Describing active structures properly: can after also be before? z Symmetry: not before before not after after start finish forth back item after before count Valid cursor positions z For symmetry and consistency, it is desirable to have the invariant properties. after = (index = count + 1) A before = (index = 0) 3 Designing for consistency (continued) z Typical iteration: from start until after loop some_action (item) forth end z Conventions for an empty structure? • after must be true for the iteration. • For symmetry: before should be true too. z But this does not work for an empty structure (count = 0, see invariant A): should index be 0 or 1? 4 2 A list before after item "Maurer" 1 count Cursor back forth start finish index 5 Designing for consistency (continued) To obtain a consistent convention we may transform the invariant into: after = (is_empty or (index = count + 1)) B before = (is_empty or (index = 0) -- Hence: is_empty = (before and after) Symmetric but unpleasant. Leads to frequent tests of the form if after and not is_empty then ... instead of just if after then ... 6 3 Introducing sentinel items z Invariant (partial): 0 <= index index <= count + 1 before = (index = 0) A after = (index = count + 1) not (after and before) before not after; not before after not after 1 <= index; index <= count not before 01 item count count + 1 Valid cursor positions 7 The case of an empty structure 0 1 (i.e.
    [Show full text]
  • Supporting by Light-Weight Specifications the Liskov
    From Types to Contracts: Supporting by Light-Weight Specifications the Liskov Substitution Principle∗ Wolfgang Schreiner Research Institute for Symbolic Computation (RISC) Johannes Kepler University Linz, Austria [email protected] February 24, 2010 Abstract In this paper we review the main theoretical elements of behavioral subtyping in object-oriented programming languages in a semi-formal style that should allow software developers to understand better in which situations the Liskov substitution principle (objects of subclasses may stand for objects of superclasses) is violated. We then shortly discuss the specification of class contracts in behavioral specification languages that allow to ensure that the substitution principle is preserved. Since many software developers may shy away form these languages because the learn- ing curve is esteemed as too steep, we propose a language of light-weight specifications that provides by a hierarchy of gradually more expressive specification forms a more lenient path towards the use of behavioral spec- ification languages. The specifications do not demand the use of predicate logic; by automatic checking certain violations of the substitution princi- ple may be detected. ∗Supported by the Austrian Academic Exchange Service (OAD)¨ under the contract HU 14/2009. 1 Contents 1 Introduction 3 2 Types and Subtypes 8 3 Shared Mutable Variables 11 4 Classes and Objects 15 5 Contracts 17 6 Specifying Contracts 22 7 Light-Weight Specifications 25 7.1 nosubtype | subtype ......................... 26 7.2 core contract ............................ 27 7.3 simple contract .......................... 30 7.4 extended contract ......................... 33 7.5 full contract ............................ 33 8 Conclusions 34 2 1 Introduction Subclasses and Subtypes One of the most important features of the type systems of statically typed object oriented languages is that subclasses are in- tended to denote subtypes [3] (which is not self-evident [5]): if a class S inherits from a class T , class S extends T { ..
    [Show full text]
  • Class Invariants: Concepts, Problems and Solutions
    Class invariants: concepts, problems and solutions Bertrand Meyer Draft 4, 22 May 2021 Groucho: That’s in every contract. That’s what they call a sanity clause. Chico: Haha! You can’t fool me. There ain’t no sanity clause. From [19] Abstract Class invariants are both a core concept of object-oriented programming and the source of the two key open OO verification problems: furtive access (particularly from callbacks) and reference leak (from aliasing). Existing approaches force on programmers an unacceptable annotation burden. This article explainfps the concept of invariant and solves both problems modularly through the O-rule, defining fundamental OO semantics, and the inhibition rule, using information hiding to remove harmful reference leaks. It also introduces the concept of tribe as a basis for other possible approaches. For all readers: this article is long because it includes a tutorial, covers many examples and dispels misconceptions. To understand the key ideas and results, however, the first page-and-a-half (section 1) suffices. For non-experts in verification: all concepts are explained; anyone with a basic understanding of object-oriented programming can understand the discussion. For experts: the main limitation of this work is that it is a paper proposal (no soundness proof, no implementation). It addresses, however, the known problems with class invariants, solving such examples as linked lists and the Observer pattern, through a simple theory and without any of the following: ownership; separation logic; universe types [34]; object wrapping and unwrapping [15]; semantic collaboration, observer specifications [39, 40]; history invariants [17]; “inc” and “coop” constructs [31]; friendship construct [3]; non-modular reasoning [25].
    [Show full text]
  • Test-Driven Development (TDD)
    Test-Driven Development (TDD) EECS3311 A: Software Design Fall 2018 CHEN-WEI WANG DbC: Supplier DbC is supported natively in Eiffel for supplier: class ACCOUNT create make feature -- Attributes owner : STRING balance : INTEGER feature -- Constructors make(nn: STRING; nb: INTEGER) require -- precondition positive balance: nb > 0 do owner := nn balance := nb end feature -- Commands withdraw(amount: INTEGER) require -- precondition non negative amount: amount > 0 affordable amount: amount <= balance-- problematic, why? do balance := balance - amount ensure -- postcondition balance deducted: balance = old balance - amount end invariant -- class invariant positive balance: balance > 0 end 2 of 35 DbC: Contract View of Supplier Any potential client who is interested in learning about the kind of services provided by a supplier can look through the contract view (without showing any implementation details): class ACCOUNT create make feature -- Attributes owner : STRING balance : INTEGER feature -- Constructors make(nn: STRING; nb: INTEGER) require -- precondition positive balance: nb > 0 end feature -- Commands withdraw(amount: INTEGER) require -- precondition non negative amount: amount > 0 affordable amount: amount <= balance-- problematic, why? ensure -- postcondition balance deducted: balance = old balance - amount end invariant -- class invariant positive balance: balance > 0 end 3 of 35 DbC: Testing Precondition Violation (1.1) The client need not handle all possible contract violations: class BANK_APP inherit ARGUMENTS create make feature -- Initialization make -- Run application. local alan: ACCOUNT do --A precondition violation with tag"positive_balance" create {ACCOUNT} alan.make ("Alan", -10) end end By executing the above code, the runtime monitor of Eiffel Studio will report a contract violation (precondition violation with tag "positive balance"). 4 of 35 DbC: Testing for Precondition Violation (1.2) 5 of 35 DbC: Testing for Precondition Violation (2.1) class BANK_APP inherit ARGUMENTS create make feature -- Initialization make -- Run application.
    [Show full text]
  • Praspel: Contract-Driven Testing for PHP Using Realistic Domains Ivan Enderlin, Fabrice Bouquet, Frédéric Dadeau, Alain Giorgetti
    Praspel: Contract-Driven Testing for PHP using Realistic Domains Ivan Enderlin, Fabrice Bouquet, Frédéric Dadeau, Alain Giorgetti To cite this version: Ivan Enderlin, Fabrice Bouquet, Frédéric Dadeau, Alain Giorgetti. Praspel: Contract-Driven Testing for PHP using Realistic Domains. [Research Report] RR-8592, INRIA. 2014, pp.39. hal-01061900 HAL Id: hal-01061900 https://hal.inria.fr/hal-01061900 Submitted on 8 Sep 2014 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Praspel: Contract-Driven Testing for PHP using Realistic Domains Ivan Enderlin, Fabrice Bouquet, Frédéric Dadeau, Alain Giorgetti RESEARCH REPORT N° 8592 September 2014 Project-Team Cassis ISSN 0249-6399 ISRN INRIA/RR--8592--FR+ENG Praspel: Contract-Driven Testing for PHP using Realistic Domains Ivan Enderlin∗, Fabrice Bouquet∗, Frédéric Dadeau∗, Alain Giorgetti∗ Project-Team Cassis Research Report n° 8592 — September 2014 — 36 pages Abstract: We present an integrated contract-based testing framework for PHP. It relies on a behavioral interface specification language called Praspel, for PHP Realistic Annotation and Specification Language. Using Praspel developers can easily annotate their PHP scripts with formal contracts, namely class invariants, and method pre- and postconditions. These contracts describe assertions either by predicates or by assigning realistic domains to data.
    [Show full text]