1 © AdaCore under the GNU Free Documentation License Franco Gasperoni

2 © AdaCore under the GNU Free Documentation License Copyright Notice © ACT Europe under the GNU Free Documentation License Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; provided its original author is mentioned and the link to is kept at the bottom of every non-title slide. A copy of the license is available at:

3 © AdaCore under the GNU Free Documentation License

4 © AdaCore under the GNU Free Documentation License What is the largest software system you have built ? (in SLOC)

5 © AdaCore under the GNU Free Documentation License Small Software Systems Understandable by 1 person Can throw away & replace it to –repair / extend –port to new platform Anything is OK for small systems (< 10 Ksloc)

6 © AdaCore under the GNU Free Documentation License Medium/Large Systems Team of people No 1 person knows all its aspects Long life-span (> 10 years) CANNOT throw away & replace it to –repair / extend –port to new platform Requires organization, discipline & right tools

7 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation –privacy –abstract data types –hierarchical packages

8 © AdaCore under the GNU Free Documentation License Separate Compilation THE PROBLEMTHE PROBLEM Compiler object CODECODE Compiler object CODECODE Compiler object CODECODE LinkerLinker executable libraries

9 © AdaCore under the GNU Free Documentation License Problem with this approach CODECODE CODECODE CODECODE No structure To write your own code –YOU MUST understand everybody else’s code CODECODE CODECODE

10 © AdaCore under the GNU Free Documentation License Idea SPECIFY WHAT EACH MODULE SHOULD DO

11 © AdaCore under the GNU Free Documentation License SPECIFICATION Software module ? BODY

12 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation specification implementation specification rules in Ada

13 © AdaCore under the GNU Free Documentation License A Specification is a... CONTRACT Implementor of the module Users/clients of the module On the SERVICES provided by the module

14 © AdaCore under the GNU Free Documentation License SPEC = list of services provided BODY = implementation of the services (hidden) Software module Service_1 Service_2 Service_3 Service_1 implementation Service_2 implementation Service_3 implementation

15 © AdaCore under the GNU Free Documentation License SPECIFICATION ? BODY

16 © AdaCore under the GNU Free Documentation License Example Create a Queue module that can –Add an Integer to the Queue –See the First integer in the Queue –Get the first integer in the Queue –Test whether the Queue is Empty

17 © AdaCore under the GNU Free Documentation License package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; queue.ads

18 © AdaCore under the GNU Free Documentation License package Queue ? BODY package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; queue.ads

19 © AdaCore under the GNU Free Documentation License Using package Queue with Queue; procedure Client is Queue_Error : exception; X : Integer; begin Queue.Add (3); Queue.Add (4); if not Queue.Empty then X := Queue.Get; else raise Queue_Error; end if; end Client; client.adb

20 © AdaCore under the GNU Free Documentation License Specifications Reduce Complexity SPEC To write your own code –only need to understand specs for the services you need

21 © AdaCore under the GNU Free Documentation License package Queue ? package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; queue.ads To write Client only need to look at

22 © AdaCore under the GNU Free Documentation License Aside: use clause with Queue; use Queue; procedure Client is Queue_Error : exception; X : Integer; begin Queue. Add (3); Queue. Add (4); if not Queue. Empty then X := Queue. Get; else raise Queue_Error; end if; end Client;

23 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation specification implementation specification rules in Ada

24 © AdaCore under the GNU Free Documentation License ONE possible implementation of package Queue This implementation raises Constraint_Error if more than Max_Size elements are put in the Queue.

25 © AdaCore under the GNU Free Documentation License Circular Buffer Q 01 Max_Size - 1 Q_Last Q_First

26 © AdaCore under the GNU Free Documentation License package body Queue is Max_Size : constant := 100; type Q_Index is mod Max_Size; Q : array (Q_Index range 0.. Max_Size - 1) of Integer; Q_First : Q_Index := Q ’ First; Q_Last : Q_Index := Q_First; Size : Natural range 0.. Max_Size; procedure Add (Element : Integer) is begin Q (Q_Last) := Element; Q_Last := Q_Last + 1; Size := Size + 1; end Add;... end Queue; queue.adb

27 © AdaCore under the GNU Free Documentation License package body Queue is... function First return Integer is begin return Q (Q_First); end First; function Get return Integer is begin Q_First := Q_First + 1; Size := Size - 1; return Q (Q_First - 1); end Get; function Empty return Boolean is begin return Size = 0; end Empty; end Queue; queue.adb

28 © AdaCore under the GNU Free Documentation License ANOTHER possible implementation of package Queue

29 © AdaCore under the GNU Free Documentation License Linked List Q_Last Q_First Free

30 © AdaCore under the GNU Free Documentation License package body Queue is type Queue_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; Q_First : Element_Ptr; Q_Last : Element_Ptr; Free : Element_Ptr := new Queue_Element;... end Queue; queue.adb

31 © AdaCore under the GNU Free Documentation License package body Queue is... procedure Add (Element : Integer) is begin if Q_First = null then Q_First := Free; else Q_Last.Next := Free; end if; Q_Last := Free; Free := Free.Next; Q_Last.all := (Element, null); if Free = null then Free := new Queue_Element; end if; end Add;... end Queue; queue.adb

32 © AdaCore under the GNU Free Documentation License package body Queue is... function Get return Integer is Tmp : Element_Ptr := Q_First; begin Q_First := Q_First.Next; if Q_First = null then Q_Last := null; end if; Tmp.Next := Free; Free := Tmp; return Tmp.Val; end Get;... end Queue; queue.adb

33 © AdaCore under the GNU Free Documentation License package body Queue is... function First return Integer is begin return Q_First; end First; function Empty return Boolean is begin return Q_First = null; end Empty; end Queue; queue.adb

34 © AdaCore under the GNU Free Documentation License A Spec can have several implementations Can change implementation WITHOUT having to change ANY of the client’s code package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; package Queue is procedure Add (Element : Integer); function First return Integer; function Get return Integer; function Empty return Boolean; end Queue; queue.ads first implement. first implement. second implement. second implement.

35 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation specification implementation specification rules in Ada

36 © AdaCore under the GNU Free Documentation License In Ada Spec always checked against implementation Must with the specs that you are going to use (not in C) Packages provide multiple name spaces

37 © AdaCore under the GNU Free Documentation License Spec is checked against its body package Queue is procedure Add (Element : Integer);... end Queue; package Queue is procedure Add (Element : Integer);... end Queue; package body Queue is... procedure Add (Element : Integer; X : Float) is... end Add;... end Queue; package body Queue is... procedure Add (Element : Integer; X : Float) is... end Add;... end Queue; Compilation error

38 © AdaCore under the GNU Free Documentation License Must with Specs used with Queue; procedure Client is... begin Queue.Add (3);... end Client; Compilation error

39 © AdaCore under the GNU Free Documentation License Multiple Name Spaces package Queue is procedure Add (E : Integer);... end Queue; package Queue is procedure Add (E : Integer);... end Queue; package Set is procedure Add (E : Integer);... end Set; package Set is procedure Add (E : Integer);... end Set; with Queue; with Set; procedure Client is begin Queue.Add (3); Set.Add (99); end Client;

40 © AdaCore under the GNU Free Documentation License Use Clause and Ambiguities package Queue is procedure Add (E : Integer);... end Queue; package Queue is procedure Add (E : Integer);... end Queue; package Set is procedure Add (E : Integer);... end Set; package Set is procedure Add (E : Integer);... end Set; with Queue; use Queue; with Set; use Set; procedure Client is begin Add (123); end Client; Compilation error ambiguity

41 © AdaCore under the GNU Free Documentation License But … Ada has overloading package Queue is procedure Add (E : Integer); procedure Add (E : Float);... end Queue; package Queue is procedure Add (E : Integer); procedure Add (E : Float);... end Queue; with Queue; use Queue; procedure Client is begin Add (123); Add (3.141); end Client;

42 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation –privacy –abstract data types –hierarchical packages

43 © AdaCore under the GNU Free Documentation License package Queues is type Queue is …; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; end Queues; package Queues is type Queue is …; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; end Queues; Having Several Queues

44 © AdaCore under the GNU Free Documentation License package Queues is type Queue is …; end Queues; package Queues is type Queue is …; end Queues; !!! WARNING !!! Use Different names

45 © AdaCore under the GNU Free Documentation License Using Several Queues with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; begin Add (Q1, 123); Add (Q2, 3); Add (Q2, Get (Q1)); end Client;

46 © AdaCore under the GNU Free Documentation License One possible implementation... package Queues is type Queue is …; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; end Queues; type Q_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; type Queue is record First : Element_Ptr; Last : Element_Ptr; end record; type Q_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; type Queue is record First : Element_Ptr; Last : Element_Ptr; end record;

47 © AdaCore under the GNU Free Documentation License Client code allowed to depend on the implementation ! with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; begin Add (Q1, 123); Add (Q2, 3); Q2.Last := null; end Client; OK

48 © AdaCore under the GNU Free Documentation License Another implementation... package Queues is type Queue is …; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; end Queues; Max_Size : constant := 100; type Q_array (Natural range <>) of Integer; type Queue is record Q : Q_Array (0.. Max_Size); First : Natural; Last : Natural; Size : Natural; end record; Max_Size : constant := 100; type Q_array (Natural range <>) of Integer; type Queue is record Q : Q_Array (0.. Max_Size); First : Natural; Last : Natural; Size : Natural; end record;

49 © AdaCore under the GNU Free Documentation License … breaks client code ! with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; begin Add (Q1, 123); Add (Q2, 3); Q2.Last := null; end Client; Compilation error

50 © AdaCore under the GNU Free Documentation License Even without changing the implementation there is a PROBLEM with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; begin Add (Q1, 123); Add (Q2, 3); Q2.Last := null; end Client; Q2 is in an inconsistent state 3 3 First Last null Q2:

51 © AdaCore under the GNU Free Documentation License You need PRIVACY Exposing your data structures is risky –Client code may manipulate the structures directly without using your own services –Client code is hard to change

52 © AdaCore under the GNU Free Documentation License Think BIG what if the Queues package is used by 1000s of other packages

53 © AdaCore under the GNU Free Documentation License If there is a bug concerning a Queue, you may have to look at 1000s of packages to find the bug If you change the implementation you may have to update 1000s of packages

54 © AdaCore under the GNU Free Documentation License Programming in the Large –privacy private types private types & discriminants limited private types

55 © AdaCore under the GNU Free Documentation License Private types package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues;

56 © AdaCore under the GNU Free Documentation License In any implementation... package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; type Queue is record First : Element_Ptr; Last : Element_Ptr; end record; end Queues;

57 © AdaCore under the GNU Free Documentation License … private types are PRIVATE with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; begin Add (Q1, 123); Add (Q2, 3); Q2.Last := null; end Client; Compilation error

58 © AdaCore under the GNU Free Documentation License Advantages of private types Enforces the contract of a specification No client code can corrupt your data structures Can change implementation without changing client code

59 © AdaCore under the GNU Free Documentation License Why is the private part in the spec ? package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; type Queue is record First : Element_Ptr; Last : Element_Ptr; end record; end Queues;

60 © AdaCore under the GNU Free Documentation License … because we still need to compile the clients code with Queues; use Queues; procedure Client is Q1 : Queue; begin Add (Q1, 123); end Client;

61 © AdaCore under the GNU Free Documentation License … but you can make a private type quite private package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue_Info; type Queue is access Queue_Info; end Queues;

62 © AdaCore under the GNU Free Documentation License package body Queues is type Queue_Element; type Element_Ptr is access Queue_Element; type Queue_Element is record Val : Integer; Next : Element_Ptr; end record; type Queue_Info is record First : Element_Ptr; Last : Element_Ptr; end record;... end Queues;

63 © AdaCore under the GNU Free Documentation License Programming in the Large –privacy private types private types & discriminants limited private types

64 © AdaCore under the GNU Free Documentation License package Queues is type Queue (Max_Size : Natural) is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Q_array (Natural range <>) of Integer; type Queue (Max_Size : Natural) is record Q : Q_Array (0.. Max_Size); First : Natural; Last : Natural; Size : Natural; end record; end Queues;

65 © AdaCore under the GNU Free Documentation License with Queues; use Queues; procedure Client is Q1 : Queue (100); Q2 : Queue (250); begin Add (Q1, 123); Add (Q2, 3); end Client; Q1 can have up to 100 elmts Q2 can have up to 250 elmts

66 © AdaCore under the GNU Free Documentation License Programming in the Large –privacy private types private types & discriminants limited private types

67 © AdaCore under the GNU Free Documentation License with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; X : Integer; begin Add (Q1, 123); Add (Q1, 3); Q2 := Q1; X := Get (Q2); end Client; Does this affect Q1 ?

68 © AdaCore under the GNU Free Documentation License it depends on … the implementation ! If a Queue is implemented with –a pointer then Get (Q2) MODIFIES Q1 –a record containing an array then Get (Q2) does NOT modify Q1

69 © AdaCore under the GNU Free Documentation License with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; X : Integer; begin Add (Q1, 123); Add (Q1, 3); Q2 := Q1; X := Get (Q2); end Client; 123 Q1: 3 3 Q2: 123 Q1: 123 Q1: 3 3 Q2: Pointer implementation

70 © AdaCore under the GNU Free Documentation License limited private types NO assignment := NO equality comparison =

71 © AdaCore under the GNU Free Documentation License package Queues is type Queue is limited private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; package Queues is type Queue is limited private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues;

72 © AdaCore under the GNU Free Documentation License with Queues; use Queues; procedure Client is Q1 : Queue; Q2 : Queue; X : Integer; begin Add (Q1, 123); Add (Q1, 3); Q2 := Q1; end Client; COMPILATION ERROR := forbidden

73 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation –privacy –abstract data types –hierarchical packages

74 © AdaCore under the GNU Free Documentation License Queue is an Abstract Data Type (ADT) Set of abstract values (data domain) collection of abstract Operations (routines that manipulate the values) ADT =

75 © AdaCore under the GNU Free Documentation License Queue is an ADT package Queues is type Queue is limited private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; package Queues is type Queue is limited private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; operations values

76 © AdaCore under the GNU Free Documentation License Objects & Variables OBJECT = instance of an ADT –piece of memory containing values of the ADT VARIABLE = name of a specific object not all objects have a name

77 © AdaCore under the GNU Free Documentation License My_Q : Queue; Memory Queue object an object name of the object

78 © AdaCore under the GNU Free Documentation License type Queue_Ptr is access Queue; Ptr : Queue_Ptr; Ptr := new Queue; Memory Queue object not all objects have a name object has no name Ptr is just a pointer to the object

79 © AdaCore under the GNU Free Documentation License CLASS = ADT + inheritance

80 © AdaCore under the GNU Free Documentation License operation Private data operation ENCAPSULATION invoke some operation in the SPEC to use ADT services

81 © AdaCore under the GNU Free Documentation License The object model

82 © AdaCore under the GNU Free Documentation License The C model C module GLOBAL DATA

83 © AdaCore under the GNU Free Documentation License Programming in the Large –specification & implementation –privacy –abstract data types –hierarchical packages

84 © AdaCore under the GNU Free Documentation License To add functionality... package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; function Last (Q : Queue) return Integer; Must add it to Queues Queue is a private type

85 © AdaCore under the GNU Free Documentation License But... Every time you change a spec you must recompile all its clients Every time you change a module you must RETEST the whole module

86 © AdaCore under the GNU Free Documentation License Solution: use child units package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; queues.ads function Queues. Last (Q : Queue) return Integer; queues-last.ads Child subprogram

87 © AdaCore under the GNU Free Documentation License Child Units Rules The body or private part of a child unit can see the private part of all of its parents The spec of a child unit does NOT

88 © AdaCore under the GNU Free Documentation License Using a child unit with Queues; use Queues; with Queues.Last; procedure Client is Q : Queue; X : Integer; begin Add (Q, 123); Add (Q, 3); X := Queues.Last (Q); end Client;

89 © AdaCore under the GNU Free Documentation License package Queues is type Queue is private; procedure Add (Q : Queue; Element : Integer); function First (Q : Queue) return Integer; function Get (Q : Queue) return Integer; function Empty (Q : Queue) return Boolean; private type Queue is …; end Queues; queues.ads package Queues. New_Functionality is function Last (Q : Queue) return Integer; end Queues. New_Functionality queues-new_functionality.ads Child package

90 © AdaCore under the GNU Free Documentation License with Queues; use Queues; with Queues.New_Functionality; procedure Client is Q : Queue; X : Integer; begin Add (Q, 123); Add (Q, 3); X := Queues.New_Functionality.Last (Q); end Client;