Design by contract What is meant by "design by contract" or CS 619 Introduction to OO Design "programming by contract"? and Development contract: An agreement between classes/objects and their clients about how they will be used. Design by Contract ! used to assure that objects always have valid state ! non-software contracts: bank terms, product warning labels Fall 2013 ! To ensure every object is valid, show that: ! constructors create only valid objects ! all mutators preserve validity of the object ! How to enforce a contract? Example contract issue Design by Contract! " A potential problem situation: queue class with " Proposed by Bertrand Meyer for Eiffel remove or dequeue method " Organize communication between software elements – client may try to remove from an empty queue by organizing mutual obligations and benefits " What are some options for how to handle this? " Use a metaphor of – clients: receive services from suppliers ! declare it as an error (an exception) – suppliers: supply services ! tolerate the error (return null) ! print an error message inside the method Client Supplier ! bad because it should leave this up to the caller Obligation Satisfy supplier Guarantee service ! repair the error in some way (retry, etc.) requirement ! bad because it should leave this up to the caller Benefit Get service Impose requirements The decision we make here becomes part of the contract of the queue class! Example: Design by Contract == Dont accept anybody elses garbage! Client UPS Obligation Provide package of Deliver package to no more than 5kg, recipient in 24 hours each dimension less or less than 2 meters. Pay postage Benefit Get package No need to deal delivered in 24 with deliveries that hours or less are too big, too heavy or unpaid Client Supplier Obligation Precondition Post-condition Benefit Post-condition Precondition Pre-condition Post-conditions " Whose fault is it when a postcondition is not " What happens when a precondition is not met, and what should be done? met? ! postcondition: Something that must be true upon precondition: Something that must be true before object completion of the object's work. promises to do its work. ! Example: At end of sort(int[]), the array is in sorted order. ! Example: A hash map class has a put(key, value) and a get(key) ! Check them with statements at end of methods, if needed. method. ! A postcondition being violated is object's (your) own fault. ! A precondition of the get method is that the key was not modified since the time you put it into the hash map. ! Assert the postcondition, so it crashes if not met. ! If precondition is violated, object may choose any action it likes ! Don't throw an exception -- it's not the client's fault! ! If key was modified, the hash map may state that the key/value is not found, even though it is in the map. ! Document postconditions in Javadoc with tag @post.condition! ! Document preconditions in Javadoc with tag @pre.condition Class invariants Programming Language Support " How is it enforced? " Eiffel : Design as such, but limited usage class invariant: A logical condition that always holds " C++: for any object of a class. – assert() does not throw an exception ! Example: Our account's balance should never be negative. – ! Similar to loop invariants, which are statements that must Documentation extraction difficult be true on every iteration of a loop. " Java ! Can be tested at start or end of every method. – ASSERT is standard since Java 1.4 ! Assert your invariants, so it crashes if they are not met don't throw an exception -- it's not the client's fault! – JavaDoc annotation ! Document class invariants in the Javadoc comment header at the top of the class. (no special javaDoc tag) Programming Language Support Example:Effiel Example: Stack Specification Stack! Eiffel class stack Effiel Example: Map insert()! Implementors of stack promise • Eiffel is designed as such ... but only used in limited cases invariant: (isEmpty (this)) or that invariant will be true after all (! isEmpty (this)) methods return (incl. constructors) C++ • assert()put (inx: C++ELEMENT assert.h; keydoes: STRING not throw) isan exception public char pop () • It’s possible to mimic assertions (incl. compilation option) in C++ Clients of stack promise -- Insert x so that it will be retrievable through key. require: ! isEmpty (this) + (see “Another Mediocre Assertion Mechanism for C++” ensure: true precondition will be true before require calling pop() by Pedro Guerreiro count in TOOLS2008) <= capacity • Documentation extraction not is key.emptymore difficult but feasible public void push (char) do require: true Implementors of stack promise Java ... Some insertion algorithm ... ensure: (! isEmpty (this)) postcondition will be true after • ASSERT is standard ensure since Java 1.4 Design byand (topContract (this) = char)in UML push() returns Design by Contract in UML ... however limited “design has by (x )contract” only; acknowledge by Java designers + see http://java.sun.com/j2se/1.4/docs/guide/lang/assert.html item (key) = x public void top (char) : char Stack • Documentation extraction count using = JavaDocold count annotations + 1 <<precondition>> <<in require:variant>> ... pop Stack(): char Left as an exercise end (! isEmpty (this)) (isEmpt ensure:y (this)) ... or push (char) <<precondition>> public<<inv ariant>>void isEmpty () pop: boolean (): char (! isEmpty (this)) isEmpty(): boolean (! isEmpty (this)) require: ... (isEmpty (this)) or push (char) <<postcondition>> Smalltalk (and other languages) ensure: ... top(): char (! isEmpty (this)) isEmpty(): boolean (! isEmpty (this)) and • Possible to mimic; compilation option requires language idioms <<postcondition>> top(): char (top (this) = char) • Documentation extraction is possible (style Javadoc) 6. Design by Contract (! isEmpty (this)) and 8 (top (this) = char) So what: isn’t this pure documentation? Who will (a) Register these contracts for later reference (the book of laws)? 6. Design by Contract 15 (b) Verify that the parties satisfy their contracts (the police)? SoAnswer what: isn’t this pure documentation? Who will (a) The source code (a)(b) Register The running these contracts system for later reference (the book of laws)? Quiz: What happens when a pre-condition is NOT satisfied ? (b) Verify that the parties satisfy their contracts (the police)? Answer (a) The source code (b) The running system 6. Design by Contract Quiz: What happens when a pre-condition is NOT satisfied ? 9 Assertions Assertions in Source Code • assertion = any boolean expression we expect to be true at some point. 6. Design by Contract 9 public char pop() throws AssertionException { my_assert(!this.isEmpty()); Assertions.. return _store[_size--]; • Help in writing correct software my_assert(invariant()); ➡ formalizing invariants, and pre- and post-conditions my_assert(true); //empty postcondition • Aid in maintenance of documentation } ➡ specifying contracts IN THE SOURCE CODE ➡ tools to extract interfaces and contracts from source code • Serve as test coverage criterion private boolean invariant() { ➡ Generate test cases that falsify assertions at run-time return (_size >= 0) && (_size <= _capacity);} • Should be configured at compile-time ➡ to avoid performance penalties with trusted parties ➡ What happens if the contract is not satisfied? private void my_assert(boolean assertion) throws AssertionException { if (!assertion) { Should be turned on/off via Quiz: What happens when a pre-condition is NOT satisfied ? throw new AssertionException compilation option • = What should an object do if an assertion does not hold? ("Assertion failed");} ➡ Throw an exception. } 6. Design by Contract 11 6. Design by Contract 12 Assertion Violations Assertions in Java The assertions can be monitored dynamically at run-time " Java assert statements to debug the software – assert <condition> ; – A precondition violation would indicate a bug at the – assert <condition> : <message>; caller " will raise an AssertionError if " – A postcondition violation would indicate a bug at the <condition> is false. callee " enabling assertions – when compiling: javac -source 1.5 Our goal is to prevent assertion violations from happening ClassName.java – The pre and postconditions are not supposed to fail if – when running: java -ea ClassName the software is correct ( so they differ from exceptions and exception handling) " In C/C++, assert is a compile-time thing. In Java, can selectively en/disable assertions at runtime. Debug and ship builds Checking Pre-conditions! Most companies have at least two versions of their code: " debug build : has special code only for the developer Assert pre-conditions to inform clients when they – debug print statements or graphical output violate the contract. " – assertions for pre/postconditions, invariants " public Object top() {! " !assert(!this.isEmpty()); !// pre-condition! " ship build : meant to be used by customers " !return top.item;! – Users expect reasonable performance and reliability. }! – The app should not spend a lot of time checking for " pre/post or invariants (in ship build). ! " The same code is used to make debug and ship build. Always check pre-conditions, raising exceptions if they – special flags (e.g. DEBUG_MODE) turn on and off debug code fail.! – in Java, VM can be run with flags to turn on/off debug also Checking Post-conditions! Checking Class Invariants! Assert post-conditions and invariants to inform yourself when you violate the contract." Every class has its own invariant:!