240 likes | 752 Views
Programming pre- and postconditions , invariants and method contracts. 201300071-1B Module 2: Software Systems 13 November 2013. Overview programming line. Preconditions , postconditions Class invariants Programming via contract Nino & Hosch : Chapter 5 Manual: JML appendix
E N D
Programmingpre- andpostconditions, invariantsandmethodcontracts 201300071-1B Module 2: Software Systems 13 November 2013
Overview programming line Software Systems - Programming
Preconditions, postconditions Class invariants Programming via contract Nino & Hosch: Chapter 5 Manual: JML appendix Tool support: OpenJML contents Software Systems - Programming
Counter - value + getValue() + reset() + next() This is only correct if the result of getValue()always is positive Example: usage of class Counter public classTennisPlayer{ Counter fh, bh; public voidhitForehand() { fh.next(); } public voidhitBackhand() {...} public inttotalHits() { returnfh.getValue() + bh.getValue(); } } postconditions Software Systems - Programming
public class Counter {privateint value; public Counter( ) { value = 0; } // always returns a positive value //@ ensures \result >= 0; public intgetValue( ) { return value; } // rest of class } Postcondition of getVAlue Informal Formal Software Systems - Programming
Unambiguous He ate the cookies on the couch Eating(p, cookies) /\ Sitting(p, couch) Or Eating(p, cookies) /\ Sitting(cookies, couch) Can be checked • Clear connection with program code and variables • Often executable Advantages of formal specification Software Systems - Programming
Property that always holds when the method terminates Caller can rely on this Examples The result of getValue() is always positive: \result >= 0 After a call to next()the result of getValue() is always equal to the result ofgetValue()before the call plus 1: getValue() == \old(getValue()) + 1 Postcondition definition Software Systems - Programming
Language for writing behaviour specifications of Java programs Syntax: Java with specification-specific extensions • \result • \old(E) • ==> (implies) • \forall, \exists Specifications written as special Java comments (start with @) OpenJML: type checking of specifications Complete language description: see jmlspecs.org Java modelling language (JML) Conditional expression in Java: <Cond> ? <E1> : <E2>; Resembles language used in book, but with tool support Software Systems - Programming
//@ ensures getValue() == \old(getValue()) + 1; public void next( ) { value = value + 1; } Requires that getValue does not have side effects /*@ pure */ public intgetValue() Allows to use getValue() in specification Checks purity separately Method calls in specifications If specifications can have side effects: execution with and without precondition check would have different behaviour Software Systems - Programming
Also okay: • /*@ requires v >= 0 */ • ensures getValue() == v */ • public voidsetValue(int v) {...} Suppose we add a method setValue(int v) to the Counter //@ requires v >= 0; //@ ensures getValue() == v; public voidsetValue(int v) {...} This postcondition can only be guaranteed if v is positive (because specification of getValue() ensures this is always positive) This is specified as a precondition (keyword: requires) preconditions Software Systems - Programming
Preconditions! Class Lock public Lock(int code) public booleanisOpen() public void close() public voidenterDigits(int digit) Only functions correctly if: • 0 <= code and code <= 999 • 0 <= digit and digit <= 9 The caller has to ensure this The Lock implementation does not have to check this Another example Software Systems - Programming
Condition that should always hold when a method is called Caller has to ensure this Examples The value of the code parameter in the Lock constructor should be between 0 en 999 requires 0 <= code && code <= 99; The reset method can only be called when the counter has reached MAX requires getValue() == Counter.MAX; Definition precondition Software Systems - Programming
Example: Counter public intgetValue() public voidsetValue(int v) public void next() public void previous() Possible preconditions • setValue(int v): v >= 0 • previous(): getValue() > 0 Why? • Pro: Saves a test in the implementation • Contra: forces the caller to do a call Preconditions should not be too strong Software Systems - Programming
Pre- and postconditions are documentation about the behaviour of the class to the outside world Therefore, they should respect visibility rules of the class Private fields cannot be used in (public) specifications //@ ensures value == \old(value) + 1; public void next( ) { value = value + 1; } Reason: internal representation might change, but outside behaviour might be unchanged Visibility of pre- and postconditions X Software Systems - Programming
Some properties hold for every internal reachable state of an object Example public invariant getValue() >= 0; Public invariant: uses only publicly visible methods Private invariant: about internal state, not visible as documentation of the class, but considers implementation private invariant value >= 0; invariants Software Systems - Programming
In general: a property that always holds In our setting: • A property that holds for all visible reachable states of all class instances • Can refer to internal state of the object (this is the definition of Nino & Hosch) • Can also be public documentation of the behaviour of a class Definition invariant Software Systems - Programming
Basic principle • If caller respects preconditions, the method implementation guarantees postconditions • Class invariant helps to show that implementation ensures postconditions Problem • Can client be trusted? • What if client does not respect the postcondition? • Method will not guarantee postconditions • Next methods are called under wrong conditions • Program does not behave properly Programming by contract Software Systems - Programming
Assumption Client will always respect preconditions Consequences No special precautions necessary Justified when client and server are developed together. Answer 1: trust client Software Systems - Programming
Assumption • Client will not always respect preconditions • When this happens,program should stop, but in controlled manner Consequences • Implementation checks (some) preconditions • assert precondition stop program when precondition not respected • In particular useful to make sure internal invariants are preserved • Applicable to larger programs Answer 2: generate error message Software Systems - Programming
Assumptions • Client will make mistake (might even be on purpose) • Program should not fail Consequences • Implementation checks all preconditions • Precondition not respected choose appropriate emergency solution (for example: default values) • Postcondition and invariant always respected • Useful for critical applications Answer 3: defensive programming Software Systems - Programming
Out of scope Use dedicated tool to insert pre- and postcondition checks during execution Construct formal proof that • Preconditions hold at every method calls • Postconditions hold at every method exit OpenJML: RAC – runtime assertion checking ESC – extended static checking Answer 4: CHECKor verify Software Systems - Programming
Behaviour of methods formally specified Precondition: what should hold when method is called Postcondition: what does implementation guarantee when method finishes Class invariant: property that holds throughout life of object Specifications can be checked during execution • Insert checks manually (using asserts) • Use dedicated tool support Main points Software Systems - Programming