• Keine Ergebnisse gefunden

Exercise1QuestionsExercise2IntroductiontoJML PracticeSheet8(HintsandComments) AdvancedAspectsofObject-OrientedProgramming(SS2011)

N/A
N/A
Protected

Academic year: 2022

Aktie "Exercise1QuestionsExercise2IntroductiontoJML PracticeSheet8(HintsandComments) AdvancedAspectsofObject-OrientedProgramming(SS2011)"

Copied!
2
0
0

Wird geladen.... (Jetzt Volltext ansehen)

Volltext

(1)

Prof. Dr. A. Poetzsch-Heffter Dipl.-Inform. Kathrin Geilmann

University of Kaiserslautern Department of Computer Science Software Technology Group

Advanced Aspects of Object-Oriented Programming (SS 2011) Practice Sheet 8 (Hints and Comments)

Exercise 1 Questions

Exercise 2 Introduction to JML

a) • Advantages

– Formal Specifications are precise, therefor they avoid the ambiguities of natural languages.

– Formal Specifications can be executable. This allows a (semi-) automatical verification (→ theoreme provers, tools like boogie, etc.).

– Enforces “Think before you code”. The developer has to think about the precise meaning of the inter- faces he uses, this allows to detect errors and problem quite early in the development process.

• Disadvantage

– Formal Specifications are more di ffi cult to write than code, because they need more knowledge about mathematics, abstraction, etc.

– Another language to learn.

– Formal specifications can be longer than descriptions in natural languages or than the specified source.

– Every method is written twice, once in den specification language and once in code.

– Problem: How to decide, that a specification is complete / precise enough?

b) - c) -

d)

c l a s s B e h a e l t e r {

/∗@ n o n _ n u l l @∗/ / / p a r t o f t h e c l a s s i n v a r i a n t , o t h e r w i s e e x t r a c t M i n f a i l s . i n t[ ] a ;

i n t n ;

/ /@ i n v a r i a n t 0 < n && n <= a . l e n g t h ; / / n+1 i s a v a l i d i n d e x i n a [ ] /∗@ r e q u i r e s i n p u t != n u l l ;

@ a s s i g n a b l e n , a ;

@ e n s u r e s n == i n p u t . l e n g t h &&

@ (\f o r a l l i n t i ; 0 <= i && i < i n p u t . l e n g t h ; a [ i ] == i n p u t [ i ] ) &&

@ a . l e n g t h == i n p u t . l e n g t h ;

@

∗/

B e h a e l t e r ( i n t[ ] i n p u t ) { n = i n p u t . l e n g t h ; a = new i n t[ n ] ;

S y s t e m . a r r a y c o p y ( i n p u t , 0 , a , 0 , n ) ; }

/∗@ r e q u i r e s 0 < n ;

@ a s s i g n a b l e n , a ;

@ e n s u r e s \r e s u l t == (\min i n t i ; 0 <= i && i < \o l d ( n ) ; \o l d ( a [ i ] ) ) ;

∗/

i n t e x t r a c t M i n ( ) {

i n t m = I n t e g e r . MAX_VALUE;

i n t mindex = 0 ;

/∗@ m a i n t a i n i n g m >= (\min i n t j ; 0 <= j && j < a . l e n g t h ; a [ j ] ) ;

∗/

f o r (i n t i = 0 ; i < n ; i++) { i f ( a [ i ] <m) {

mindex = i ;

m= a [ i ] ; }

} n− −;

a [ mindex ] = a [ n ] ; r e t u r n m;

} }

(2)

e) Add n < old(n) to the postcondition of extractMin or use a history constraint like constraint n < old(n) f) Translate the documentation of the class ByteArrayInputStream directly into jml.

p u b l i c c l a s s B y t e A r r a y I n p u t S t r e a m e x t e n d s I n p u t S t r e a m { p r o t e c t e d /∗@ s p e c _ p u b l i c n o n _ n u l l @∗/ b y t e[ ] b u f ; p r o t e c t e d /∗@ s p e c _ p u b l i c @∗/ i n t c o u n t ;

p r o t e c t e d /∗@ s p e c _ p u b l i c @∗/ i n t mark ;

p r o t e c t e d /∗@ s p e c _ p u b l i c @∗/ i n t p o s ; /∗@ p u b l i c i n v a r i a n t ( c o u n t>=0&& c o u n t<=b u f . l e n g t h ) &&

@ ( mark>=0 && mark<=c o u n t ) &&

@ ( pos>=0 && pos<=c o u n t ) ;

@∗/

/∗@ r e q u i r e s b !=n u l l ;

@ a s s i g n a b l e b u f , pos , c o u n t , mark ;

@ e n s u r e s b u f==b &&

@ p o s==0 &&

@ c o u n t==b . l e n g t h &&

@ mark==0;

@∗/

p u b l i c B y t e A r r a y I n p u t S t r e a m (b y t e[ ] b ) ; /∗@ r e q u i r e s b !=n u l l &&

@ o f f s e t>=0 &&

@ l e n g t h>=0 &&

@ a s s i g n a b l e b u f , pos , c o u n t , mark ;

@ e n s u r e s b u f==b &&

@ p o s==o f f s e t &&

@ c o u n t==( o f f s e t+l e n g t h<b u f . l e n g t h ) ? o f f s e t+l e n g t h : b u f . l e n g t h &&

@ mark==o f f s e t ;

@∗/

p u b l i c B y t e A r r a y I n p u t S t r e a m (b y t e[ ] b , i n t o f f s e t , i n t l e n g t h ) ; /∗@ r e q u i r e s t r u e ;

@ e n s u r e s \r e s u l t==( c o u n t−p o s ) ;

@∗/

p u b l i c /∗@ p u r e @∗/ i n t a v a i l a b l e ( ) ; /∗@ r e q u i r e s t r u e ;

@ e n s u r e s t r u e ;

@∗/

p u b l i c v o i d /∗@ p u r e @∗/ c l o s e ( ) t h r o w s I O E x c e p t i o n ; /∗@ r e q u i r e s t r u e ;

@ a s s i g n a b l e mark ;

@ e n s u r e s mark==p o s ;

@∗/

p u b l i c v o i d mark (i n t r e a d A h e a d L i m i t ) ; /∗@ r e q u i r e s t r u e ;

@ e n s u r e s \r e s u l t==t r u e ;

@∗/

p u b l i c b o o l e a n /∗@ p u r e @∗/ m a r k S u p p o r t e d ( ) ; /∗@ r e q u i r e s t r u e ;

@ a s s i g n a b l e p o s ;

@ e n s u r e s a v a i l a b l e ( )==0 => (\r e s u l t==−1&& p o s==\o l d ( p o s ) ) &&

@ a v a i l a b l e ( )>0 => ( (\r e s u l t==b u f [ p o s ] && p o s==\o l d ( p o s )+1 ) &&

@ \r e s u l t>=0&& \r e s u l t<=2 5 5 ) ;

@∗/

p u b l i c i n t r e a d ( ) ; /∗@ r e q u i r e s b !=n u l l &&

@ o f f>=0 &&

@ l e n>=0 &&

@ ( o f f+l e n )<b . l e n g t h ;

@ a s s i g n a b l e p o s ;

@ e n s u r e s a v a i l a b l e ( )==0 => (\r e s u l t==−1&& p o s==\o l d ( p o s ) ) &&

@ a v a i l a b l e ( )>0 => ( (\r e s u l t==( l e n<a v a i l a b l e ( ) ) ? l e n : a v a i l a b l e ( ) &&

@ p o s==\o l d ( p o s )+ \r e s u l t ) &&

@ (\f o r a l l i n t k ; 0<k && k<\r e s u l t ; b u f [ o f f+k ]==b [ o f f+k ] ) ) ;

@∗/

p u b l i c i n t r e a d (b y t e[ ] b , i n t o f f , i n t l e n ) ; /∗@ r e q u i r e s t r u e ;

@ a s s i g n a b l e p o s ;

@ e n s u r e s p o s==mark ;

@∗/

p u b l i c v o i d r e s e t ( ) ; /∗@ r e q u i r e s n>=0;

@ a s s i g n a b l e p o s ;

@ e n s u r e s \r e s u l t==( a v a i l a b l e ( )<n ) ? a v a i l a b l e ( ) : n &&

@ p o s==\o l d ( p o s )+ \r e s u l t ;

@∗/

p u b l i c l o n g s k i p (l o n g n ) ; }

2

Referenzen

ÄHNLICHE DOKUMENTE

a) Model fields form a model state, which can be different from the implemented state.. The model state may be better suited for specifying the behavior of an object, because it can

b) Implement a StringReader. First add an interface equivalent to the BlankReader including the specification of the behavior. Second add an implementation of StringReader that

b) If the set of types / roles can be given at compile time and it will not change for an object during its lifecycle, it is usually a good idea to use subtyping and, if

a) Write a generic static method flip which takes an object of class Pair (see the slides of the lecture) and flips the elements of the given Pair object. Hint: In order to flip

Undesired dynamic alias: Store an alias to an object in the local variable tmp; hideAll components and make the aliased one visible again. Capturing occurs if a reference, which

”Note: great care must be exercised if mutable objects are used as map keys. The behavior of a map is not specified if the value of an object is changed in a manner that affects

• Guarantees of the type system cannot be used anymore.. b) If the set of types/roles can be given at compile time and it will not change for an object during its lifecycle, it

Context Conditions: For VarId = Exp the context conditions used for normal assignments have to be fulfilled, especially the loop variable VarId has to be declared before the loop;