1. Are Practitioners Writing Contracts?
Patrice Chalin
Dependable Software Research Group (DSRG)
Computer Science and Software Engineering Department
Concordia University
Montreal, Canada
REFT Workshop
19 July 2005 at the FM05 Formal Methods Conference, Newcastle upon Tyne, UK, July 2005

2. Tackling Increasingly Large and Complex S/W:
Modular design methodologies
have been proposed to help manage the increasing size and complexity S/W systems
Effective modularization also
Provides opportunities for reuse
In very large systems
Module / component interfaces must be rigorously defined.
9/17/2018
GC6 - DSE - P.Chalin,

3. Interface Specification of OO Sys.
… expressed by contracts (an increasingly popular method)
Design by Contract (DBC)
9/17/2018
GC6 - DSE - P.Chalin,

4. Languages Supporting DBC
Eiffel
Only active lang. with built-in support for DBC.
Whether you include Spark in this list depends on your definition of DBC. If DBC means run-time assertion checking, then Spark should be excluded from this list.
JACK uses JML (for the most part), as does ESC/Java2
9/17/2018
GC6 - DSE - P.Chalin,

5. Language Extensions for DBC
Several research efforts are underway to “add” support for DBC to other languages.
Support is added by extending a subset of the target language:
Spark for Ada*
APP for C
Spec# for C#
Java Modeling Language (JML), Jass, … for Java.
Jass, ESC/Java, Jcontract,
9/17/2018
GC6 - DSE - P.Chalin,

6. DBC Research Justified?
Does, having DBC support  developers will write contracts?
9/17/2018
GC6 - DSE - P.Chalin,

7. Survey Are practitioners writing contracts? Subjects: Eiffel programs.
Are practitioners writing assertions?
What kind of assertions?
Subjects: Eiffel programs.
Measure of the % SLOC that are assertions.
9/17/2018
GC6 - DSE - P.Chalin,

8. Eiffel: A brief review …
9/17/2018
GC6 - DSE - P.Chalin,

9. Eiffel Sample: N-ary Xor
indexing
description: "Routines that ought to be in class BOOLEAN"
library: "Gobo Eiffel Kernel Library"
copyright: "Copyright (c) 2002, Berend de Boer and others" …
revision: "$Revision: 1.2 $"
class KL_BOOLEAN_ROUTINES
feature -- Access
nxor (a_booleans: ARRAY[BOOLEAN]): BOOLEAN is
-- N-ary exclusive or
require …
local
i, nb: INTEGER do
i := a_booleans.lower
nb := a_booleans.upper
from until i > nb loop
-- Lines 27 … 37 removed
end
ensure …
Eiffel Sample: N-ary Xor
9/17/2018
GC6 - DSE - P.Chalin,

10. Eiffel Sample: N-ary Xor
indexing
description: "Routines that ought to be in class BOOLEAN"
library: "Gobo Eiffel Kernel Library"
copyright: "Copyright (c) 2002, Berend de Boer and others" …
revision: "$Revision: 1.2 $"
class KL_BOOLEAN_ROUTINES
feature -- Access
nxor (a_booleans: ARRAY[BOOLEAN]): BOOLEAN is
-- N-ary exclusive or
require …
local
i, nb: INTEGER do
i := a_booleans.lower
nb := a_booleans.upper
from until i > nb loop
-- Lines 27 … 37 removed
end
ensure …
Assertions:
Preconditions
Postconditions
Class invariants
Loop invariants
Loop variants
Check clause
Eiffel Sample: N-ary Xor
9/17/2018
GC6 - DSE - P.Chalin,

11. Eiffel: Sample Precondition
nxor(a_booleans: ...) : BOOLEAN is
require
a_booleans_not_void:
a_booleans /= Void
9/17/2018
GC6 - DSE - P.Chalin,

12. Eiffel Sample Postcondition
...
ensure
zero: a_booleans.count = 0 implies not Result
unary: a_booleans.count = 1 implies
Result = a_booleans.item (a_booleans.lower)
binary: a_booleans.count = 2 implies
Result = (a_booleans.item (a_booleans.lower) xor
a_booleans.item (a_booleans.upper))
-- more: there exists one and only one `i' in
-- a_boolean.lower..a_boolean.upper so that
-- a_boolean.item (i) = True
end
9/17/2018
GC6 - DSE - P.Chalin,

13. Eiffel Sample Postcondition
ensure
zero: …
binary: a_booleans.count = 2
implies Result = (…) xor (…)
-- more: there exists one and
-- only one `i' in
-- a_boolean.lower..a_boolean.upper
-- so that
-- a_boolean.item (i) = True
end
9/17/2018
GC6 - DSE - P.Chalin,

14. Eiffel Loops from initialization_instructions invariant assertion
until
exit_condition
loop
loop_instructions
end
9/17/2018
GC6 - DSE - P.Chalin,

15. Survey Metrics Count Lines-of-code (LOC): Blank Comment
Physical Source LOC (SLOC).
9/17/2018
GC6 - DSE - P.Chalin,

16. Subjects 80+ projects Categorized: Proprietary Open source Eiffel 5.5
9/17/2018
GC6 - DSE - P.Chalin,

17. Eiffel Survey: Project Distribution
Project Category
# of files
LOC
SLOC
Proj. Cat.
Proprietary
18584
2.7M
2.0M
51%
Open Source
10657
1.7M
1.3M
33%
Eiffel 5.5
4840
1.0M
0.7M
17%
Total
34081
5.4M
4.0M
100%
9/17/2018
GC6 - DSE - P.Chalin,

18. Eiffel Survey: General Results
LOC
SLOC
Blank
Com-ment
Index SLOC
Total (106)
5.4
4.0
0.82
0.55
0.17
% LOC
100%
74.6%
15.2%
10.2%
3.2%
9/17/2018
GC6 - DSE - P.Chalin,

19. Eiffel Survey: % SLOC that are assertions
9/17/2018
GC6 - DSE - P.Chalin,

20. Eiffel Survey: Assertions Distribution in Kind
9/17/2018
GC6 - DSE - P.Chalin,

21. Other Statistics req ens cl.inv l.inv l.var check Total
Max AsnLOC size 30 24 35 7 2 14
Average size
1.7
1.5
2.4
1.6
1.0
1.2
% (e /= Void)
44.4
23.6
51.2
2.1
0.0
35.1
36.8
9/17/2018
GC6 - DSE - P.Chalin,

22. Contracts Are Being Written
Good news for DBC researchers.
9/17/2018
GC6 - DSE - P.Chalin,

23. Beyond DBC for Fault Tolerance
“DBC” style contracts are insufficient.
Next level of specification …
9/17/2018
GC6 - DSE - P.Chalin,

24. Beyond DBC … Behavioral interface specifications Design by Contract
Ad hoc use of assertions
Assertions not used
9/17/2018
GC6 - DSE - P.Chalin,

25. Behavioral Interface Specifications
Behavioral specification also captures includes behavior in exceptional cases.
9/17/2018
GC6 - DSE - P.Chalin,

26. Multi-threaded support
Extensions to current single-threaded approaches:
JML
Spec#
9/17/2018
GC6 - DSE - P.Chalin,