Are Practitioners Writing Contracts? Patrice Chalin Dependable Software Research Group (DSRG) Computer Science and Software Engineering Department Concordia University Montreal, Canada REFT Workshop 19 July 2005 at the FM05 Formal Methods Conference, Newcastle upon Tyne, UK, 18-22 July 2005

Tackling Increasingly Large and Complex S/W: Modular design methodologies have been proposed to help manage the increasing size and complexity S/W systems Effective modularization also Provides opportunities for reuse In very large systems Module / component interfaces must be rigorously defined. 9/17/2018 GC6 - DSE - P.Chalin,

Interface Specification of OO Sys. … expressed by contracts (an increasingly popular method) Design by Contract (DBC) 9/17/2018 GC6 - DSE - P.Chalin,

Languages Supporting DBC Eiffel Only active lang. with built-in support for DBC. Whether you include Spark in this list depends on your definition of DBC. If DBC means run-time assertion checking, then Spark should be excluded from this list. JACK uses JML (for the most part), as does ESC/Java2 9/17/2018 GC6 - DSE - P.Chalin,

Language Extensions for DBC Several research efforts are underway to “add” support for DBC to other languages. Support is added by extending a subset of the target language: Spark for Ada* APP for C Spec# for C# Java Modeling Language (JML), Jass, … for Java. Jass, ESC/Java, Jcontract, 9/17/2018 GC6 - DSE - P.Chalin,

DBC Research Justified? Does, having DBC support  developers will write contracts? 9/17/2018 GC6 - DSE - P.Chalin,

Survey Are practitioners writing contracts? Subjects: Eiffel programs. Are practitioners writing assertions? What kind of assertions? Subjects: Eiffel programs. Measure of the % SLOC that are assertions. 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel: A brief review … 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Sample: N-ary Xor indexing description: "Routines that ought to be in class BOOLEAN" library: "Gobo Eiffel Kernel Library" copyright: "Copyright (c) 2002, Berend de Boer and others" … revision: "$Revision: 1.2 $" class KL_BOOLEAN_ROUTINES feature -- Access nxor (a_booleans: ARRAY[BOOLEAN]): BOOLEAN is -- N-ary exclusive or require … local i, nb: INTEGER do i := a_booleans.lower nb := a_booleans.upper from until i > nb loop -- Lines 27 … 37 removed end ensure … Eiffel Sample: N-ary Xor 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Sample: N-ary Xor indexing description: "Routines that ought to be in class BOOLEAN" library: "Gobo Eiffel Kernel Library" copyright: "Copyright (c) 2002, Berend de Boer and others" … revision: "$Revision: 1.2 $" class KL_BOOLEAN_ROUTINES feature -- Access nxor (a_booleans: ARRAY[BOOLEAN]): BOOLEAN is -- N-ary exclusive or require … local i, nb: INTEGER do i := a_booleans.lower nb := a_booleans.upper from until i > nb loop -- Lines 27 … 37 removed end ensure … Assertions: Preconditions Postconditions Class invariants Loop invariants Loop variants Check clause Eiffel Sample: N-ary Xor 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel: Sample Precondition nxor(a_booleans: ...) : BOOLEAN is require a_booleans_not_void: a_booleans /= Void 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Sample Postcondition ... ensure zero: a_booleans.count = 0 implies not Result unary: a_booleans.count = 1 implies Result = a_booleans.item (a_booleans.lower) binary: a_booleans.count = 2 implies Result = (a_booleans.item (a_booleans.lower) xor a_booleans.item (a_booleans.upper)) -- more: there exists one and only one `i' in -- a_boolean.lower..a_boolean.upper so that -- a_boolean.item (i) = True end 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Sample Postcondition ensure zero: … binary: a_booleans.count = 2 implies Result = (…) xor (…) -- more: there exists one and -- only one `i' in -- a_boolean.lower..a_boolean.upper -- so that -- a_boolean.item (i) = True end 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Loops from initialization_instructions invariant assertion until exit_condition loop loop_instructions end 9/17/2018 GC6 - DSE - P.Chalin,

Survey Metrics Count Lines-of-code (LOC): Blank Comment Physical Source LOC (SLOC). 9/17/2018 GC6 - DSE - P.Chalin,

Subjects 80+ projects Categorized: Proprietary Open source Eiffel 5.5 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Survey: Project Distribution Project Category # of files LOC SLOC Proj. Cat. Proprietary 18584 2.7M 2.0M 51% Open Source 10657 1.7M 1.3M 33% Eiffel 5.5 4840 1.0M 0.7M 17% Total 34081 5.4M 4.0M 100% 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Survey: General Results LOC SLOC Blank Com-ment Index SLOC Total (106) 5.4 4.0 0.82 0.55 0.17 % LOC 100% 74.6% 15.2% 10.2% 3.2% 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Survey: % SLOC that are assertions 9/17/2018 GC6 - DSE - P.Chalin,

Eiffel Survey: Assertions Distribution in Kind 9/17/2018 GC6 - DSE - P.Chalin,

Other Statistics req ens cl.inv l.inv l.var check Total Max AsnLOC size 30 24 35 7 2 14 Average size 1.7 1.5 2.4 1.6 1.0 1.2 % (e /= Void) 44.4 23.6 51.2 2.1 0.0 35.1 36.8 9/17/2018 GC6 - DSE - P.Chalin,

Contracts Are Being Written Good news for DBC researchers. 9/17/2018 GC6 - DSE - P.Chalin,

Beyond DBC for Fault Tolerance “DBC” style contracts are insufficient. Next level of specification … 9/17/2018 GC6 - DSE - P.Chalin,

Beyond DBC … Behavioral interface specifications Design by Contract Ad hoc use of assertions Assertions not used 9/17/2018 GC6 - DSE - P.Chalin,

Behavioral Interface Specifications Behavioral specification also captures includes behavior in exceptional cases. 9/17/2018 GC6 - DSE - P.Chalin,

Multi-threaded support Extensions to current single-threaded approaches: JML Spec# 9/17/2018 GC6 - DSE - P.Chalin,