1. Specifications

2. Announcements HW1 is due Friday To submit answers, commit Error in HW1: In problem 8, part 2 z = 0 should be z = MAX_INT 2

3. 3 So Far We discussed reasoning about code Forward reasoning and backward reasoning Hoare Logic Hoare Triples Rule for assignment Rule for sequence Rule for if-then-else Rule for method call Reasoning about loops Spring 15 CSCI 2600, A Milanova

4. Reasoning About Loops total correctness=partial correctness+termination 1. Partial correctness “Guess”, then prove loop invariant Loop invariant and loop exit condition must imply the postcondition This gives us: “If the loop terminated then the postcondtion holds”. But does the loop terminate? 2. Termination (Informally) “Guess” decrementing function D. Each iteration decrements D, D at 0 along with the loop invariant must imply loop exit condition 4

5. Precondition: len ≥ 0 ∧ a.length = len double sum = 0.0; int i = 0; { Inv: sum = a[0]+…+a[i-1] ∧ i<=len } while (i < len) { sum = sum + a[i]; i = i+1; } Postcondition: sum = a[0]+…+a[a.length-1] 5 A “tedious” Invariant 124-10… i=2 Inv: sum = a[0]+a[1]

6. Precondition: len ≥ 0 ∧ a.length = len double sum = 0.0; int i = 0; { Inv: sum = a[0]+…+a[i-1] ∧ i<=len } while (i < len) { sum = sum + a[i]; i = i+1; } Postcondition: sum = a[0]+…+a[a.length-1] 6 A “tedious” Invariant 124-10… i=3 Inv: sum = a[0]+a[1]+a[2]

7. As the induction variable i moves through the array, sum contains the correct partial result. At the end of the array, sum contains the correct total Similar invariants for min, max, avg, sorting algorithms, etc. These invariants are easy to guess. Spring 15 CSCI 2600, A Milanova 7 A “tedious” Invariant 124-10… i=a.length Inv: sum = a[0]+a[1]+…+a[a.length-1]

8. Precondition: len ≥ 0 ∧ a.length = len double sum = 0.0; int i = 0; { Inv: sum = a[0]+…+a[i-1] ∧ i<=len+1 } while (i <= len) { sum = sum + a[i]; i = i+1; } Postcondition: sum = a[0]+…+a[a.length-1] Spring 15 CSCI 2600, A Milanova 8 Let’s Catch the Bug

9. An “elegant” Invariant 9 Precondition: x1 > 0 ∧ x2 > 0 y1 = x1; y2 = x2; { Inv: gcd(y1,y2) = gcd(x1,x2) } while (y1 != y2) { if (y1 > y2) { y1 = y1-y2 } else { y2 = y2-y1; } } Postcondition: y1 = gcd(x1,x2)

10. An “elegant” Invariant 10 Precondition: x != 0 zeros = 0; y = x; while (y%10 == 0) { y = y/10; zeros = zeros + 1; } Postcondition: x = y*10 zeros ∧ y%10 != 0 There is no good way of guessing such invariants… Spring 15 CSCI 2600, A Milanova (example due to Mike Ernst)

11. An “elegant” Invariant 11 Precondition: x != 0 zeros = 0; y = x; while (y%10 == 0) { y = y/10; zeros = zeros + 1; } Postcondition: x = y*10 zeros ∧ y%10 != 0

12. Outline of Today’s Lecture Specifications Benefits of specifications Specification conventions Javadoc PoS specifications JML 12

13. Specifications A specification consists of a precondition and a postcondition Precondition: conditions that hold before method executes Postcondition: conditions that hold after method finished execution (if precondition held!) 13

14. Specifications A specification is a contract between a method and its caller Obligations of the method (implementation of the specification): agrees to provide postcondition if precondition held Obligations of the caller (user of specification): agrees to meet the precondition and not expect more than the promised postcondition A specification is an abstraction 14

15. Example Specification Precondition: len ≥ 0 ∧ a.length = len Postcondition: result = a[0]+…+a[a.length-1] double sum(int[] a, int len) { double sum = 0.0; int i = 0; while (i < len) { sum = sum + a[i]; i = i+1; } return sum; } Spring 15 CSCI 2600, A Milanova 15 For our purposes, we will be writing specifications that are a bit less formal than this example. Mathematical rigor is welcome, but not always necessary.

16. Benefits of Specifications Precisely documents method behavior Imagine if you had to read the code of the Java libraries to figure what they do! Promotes modularity Modularity is key to the development of correct and maintainable software Specifications help organize code into small modules, with clear-cut boundaries between those modules Spring 15 CSCI 2600, A Milanova 16

17. Benefits of Specifications Promote modularity… Client relies on description in specification, no need to know the implementation Method must support specification, but its implementation is free otherwise! Method and client can be built simultaneously Enables reasoning about correctness “Does code do the right thing?” means “Does code conform to its specification?” Confirmed by testing and verification 17

18. So, Why Not Just Read Code? boolean sub(List src, List part) { int part_index = 0; for (Object o : src) { if (o.equals(part.get(part_index))) { part_index++; if (part_index == part.size()) { return true; } } else { part_index = 0; } return false; } Spring 15 CSCI 2600, A Milanova (example due to Michael Ernst, UW) 18

19. So, Why Not Just Read Code? Code is complicated Gives a lot more detail than client needs Understanding code is a burden Code is ambiguous What is essential and what is incidental (e.g., result of an optimization) Client needs to know what the code does, not how it does it! Spring 15 CSCI 2600, A Milanova (based on slides by Michael Ernst, UW) 19

20. What About Comments? // method checks if part appears as // subsequence in src boolean sub(List src, List part) { … } Comments are important, but insufficient. They are informal, imprecise and often ambiguous Spring 15 CSCI 2600, A Milanova 20

21. Specifications Are Concise and Precise Unfortunately, lots of code lacks specification  Programmers guess what code does by reading the code or running it This results in bugs and/or complex code with unclear behavior Specification inference is an active area of research Spring 15 CSCI 2600, A Milanova (based on slide by Michael Ernst) 21

22. So, What’s in sub ’s Specification? boolean sub(List src, List part) { int part_index = 0; for (Object o : src) { if (o.equals(part.get(part_index))) { part_index++; if (part_index == part.size()) { return true; } } else { part_index = 0; } return false; } Spring 15 CSCI 2600, A Milanova (example due to Michael Ernst, UW) 22

23. Choice 1: // sub returns true if part is a subsequence of src ; it returns false otherwise. Choice 2: // src and part must be non-null // If src is the empty list, then sub returns false // If there is a partial match in the beginning, sub returns false, even if there is a full match later. E.g. sub ([1, 2, 1, 2, 1, 3], [1, 2, 1, 3]) is false. 23 So, What’s in sub ’s Specification?

24. What’s in sub ’s Specification? This complex specification is a red flag Rule: it is better to simplify design and code rather than try to describe complex behavior! If you end up writing a complicated specification, redesign and rewrite your code --- either something is wrong or code is extremely complex and hard to reason about (Mike Ernst calls this “a sneaky fringe benefit of specifications”) Spring 15 CSCI 2600, A Milanova (based on slides by Michael Ernst) 24

25. Goal of Principles of Software One goal of Principles of Software is to instill a discipline of writing concise and precise specifications Spring 15 CSCI 2600, A Milanova 25

26. Outline of Today’s Lecture Specifications Benefits of specifications Specification conventions Javadoc PoS specifications JML 26

27. Javadoc Javadoc convention Method’s type signature Text description of what method does Parameters: text description of what gets passed Return: text description of what gets returned Throws: list of exceptions that may get thrown Spring 15 CSCI 2600, A Milanova 27

28. Example: Javadoc for String.substring public String substring(int beginIndex) Returns a new string that is a substring of this string. The substring begins with the character at the specified index and extends to the end of the string Parameters: beginIndex --- the beginning index, inclusive. Returns: the specified substring. Throws: IndexOutOfBoundsException --- if beginIndex is negative or larger than the length of this String object. 28

29. PoS Specifications Specification convention due to Michael Ernst The precondition requires: clause spells out constraints on client The postcondition modifies: lists objects (typically parameters) that may be modified by the method. Any object not listed under this clause is guaranteed untouched throws: lists possible exceptions effects: describes final state of modified objects returns: describes return value 29

30. Example 0 String substring(int beginIndex) requires: none modifies: none effects: none returns: new string with same value as the substring beginning at beginIndex and extending until the end of current string throws: IndexOutOfBoundsException --- if beginIndex is negative or larger than the length of this String object. Spring 15 CSCI 2600, A Milanova 30

31. Example 1 static int change(List lst, T old, T newelt) requires: lst, old, newelt are non-null. old occurs in lst. modifies: lst effects: change first occurrence of old in lst with newelt. makes no other changes. returns: position of element in lst that was old and now newelt Spring 15 CSCI 2600, A Milanova (due to Michael Ernst) 31 static int change(List lst, T old, T newelt) { int i = 0; for (T curr : lst) { if (curr == old) { lst.set(i, newelt); return i; } i = i + 1; } return -1; }

32. Example 2 static List listAdd(List lst1, List lst2) requires: lst1, lst2 are non-null. lst1 and lst2 are same size. modifies: none effects: none returns: a new list of the same size, whose i-the element is the sum of the i-the elements of lst1 and lst2 Spring 15 CSCI 2600, A Milanova (due to Michael Ernst) 32 static List listAdd(List lst1, List lst2) { List res = new ArrayList (); for (int i = 0; i < lst1.size(); i++) res.add(lst1.get(i) + lst2.get(i)); return res; }

33. Aside: Autoboxing and Unboxing Boxed primitives. E.g., int vs. Integer Autoboxing: automatic conversion from primitive to boxed type Java generics require reference type arguments ArrayList al = new … for (int i=0; i<10; i++) al.add(i); Unboxing: automatic conversion from boxed type to primitive res.add(lst1.get(i) + lst2.get(i)) 33

34. Example 3 static void listAdd2(List lst1, List lst2) requires: ?? modifies: ?? effects: ?? returns: ?? Spring 15 CSCI 2600, A Milanova (due to Michael Ernst) 34 static void listAdd(List lst1, List lst2) { for (int i = 0; i < lst1.size(); i++) { lst1.set(i,lst1.get(i) + lst2.get(i)); }

35. Example 4 static void uniquefy(List lst) requires: ? modifies: ? effects: ? returns: ? Spring 15 CSCI 2600, A Milanova (due to Michael Ernst) 35 static void uniquefy(List lst) { for (int i = 0; i < lst.size()-1; i++) if (lst.get(i) == lst.get(i+1)) lst.remove(i); }

36. Example 5 private static void swap(int[] a, int i, int j) requires: ? modifies: ? effects: ? returns: ? Spring 15 CSCI 2600, A Milanova 36 static void swap(int[] a, int i, int j) { int tmp = a[j]; a[j] = a[i]; a[i] = tmp; }

37. Example 6 private static void selection(int[] a) requires: ? modifies: ? effects: ? returns: ? Spring 15 CSCI 2600, A Milanova 37 static void selection(int[] a) { for (int i = 0; i < a.length; i++) { int min = i; for (int j = i+1; j < a.length; j++) if (a[j] < a[min]) min = j; swap(a, i, min); }

38. Javadoc for java.util.binarysearch public static int binarySearch(int[] a,int key) Searches the specified array of ints for the specified value using the binary search algorithm. The array must be sorted (as by the sort method, above) prior to making this call. If it is not sorted, the results are undefined. If the array contains multiple elements with the specified value, there is no guarantee which one will be found. Parameters: a - the array to be searched. key - the value to be searched for. Spring 15 CSCI 2600, A Milanova 38

39. Javadoc for java.util.binarysearch Returns: index of the search key, if it is contained in the array; otherwise, (-(insertion point) - 1). The insertion point is defined as the point at which the key would be inserted into the array; the index of the first element greater than the key, or a.length if all elements in the array are less than the specified key. Note that this guarantees that the return value will be >= 0 if and only if the key is found. So, what is wrong with this spec? Spring 15 CSCI 2600, A Milanova 39

40. Better binarySearch Specification public static int binarySearch(int[] a,int key) Precondition: requires: a is sorted in ascending order Postcondition: modifies: none effects: none returns: i such that a[i] = key if such an i exists a negative value otherwise Spring 15 CSCI 2600, A Milanova (based on slide by Michael Ernst) 40

41. Shall We Check requires Clause? If client (i.e., caller) fails to provide the preconditions, method can do anything --- throw an exception or pass bad value back It is polite to check Checking preconditions Makes an implementation more robust Provides feedback to the client Avoids silent errors Spring 15 CSCI 2600, A Milanova (based on slides by Michael Ernst) 41

42. Rule If private method, may not check If public method, do check unless such a check is expensive E.g., requires: lst is non-null. Check E.g., requires: lst contains positive integers. Don’t check Spring 15 CSCI 2600, A Milanova 42

43. Shall We Check requires Clause? Example 1: requires: lst, old, new are non-null. old occurs in lst. Check? Example 2: requires: lst1, lst2 are non- null. lst1 and lst2 are same size. Check? binarySearch: requires: a is sorted. Check? Spring 15 CSCI 2600, A Milanova 43

44. The JML Convention Javadocs and PoS specifications are not machine-checkable JML (Java Modeling Language) is a formal specification language Builds on the ideas of Hoare logic End goal is automatic verification Does implementation obey contract? Given a spec S and implementation I, does I conform to S? Does client obey contract? Does it meet preconditions? Does it expect what method provides? 44

45. The JML Spec for binarySearch Precondition: requires: a != null && (\forall int i; 0 < i && i < a.length; a[i-1] <= a[i]; Postcondition: ensures: // complex statement… Difficult problem and an active research area. Look up Sir Tony Hoare’s Grand Challenge 45