Mit6.031 software construction7 reading notesdesigning specifications

1、 The article links

Reading 7: Designing Specifications

2、 Article content

This article studies different norms of quasi - behavior , And discuss the trade-offs between them . We will explore what makes some specifications better than others . Compare from the following three aspects ：

• Whether there is certainty , namely , What is given is certain postcondition, Or one of many possibilities .
• How descriptive , It explains all the steps , Or just give the results and the relationship between output and input .
• How strong ,postcondition and precondition The intensity of .

（1） deterministic vs uncertainty

deterministic ： When presenting a condition that meets the prerequisites , The result is absolutely certain . Only one return value and one final state are possible . Valid input without multiple valid outputs . 

The difference of certainty is not equal to uncertainty , Uncertainty must introduce randomization elements .

（2） Declarative vs Operability

Operation specification A series of steps of this method are given ; Pseudo code description is operational . 

Declarative specification No details of the intermediate steps are given .

contrary , They are just attributes that give the final result , And its relationship with the initial state .

（3） stronger vs Weaker

To answer this question , We draw the concept of strength from logic . The predicate P yes stronger Ratio predicate Q （ also Q yes Weak Than P） If the match P The state set of is a match Q A strict subset of the states of . take “ stronger ” To be regarded as more constrained or strict , and “ Weaker ” Is less constrained 、 Looser may help . for example , The precondition is the predicate on the input state , So making the prerequisites stronger means reducing the set of legitimate inputs . A postcondition is a predicate on the output state , Therefore, a stronger post condition will reduce the allowed output and effect set . A specification is a predicate for implementation , So a stronger specification will narrow the set of legitimate implementations . Please note that , If P and Q Are not a subset of another , that P and Q Or maybe Can't compare —— Neither strong nor weak .
standard S2 Stronger than or equal to the specification S1 If and only if

• S2 The precondition of is weaker than or equal to S1 The premise of ,
  also
• For satisfying S1 The state of the precondition ,S2 The postcondition of is stronger than or equal to S1 Post condition of .

If that's the case , So satisfied S2 The implementation of can also be used to meet S1, And use... In the program S2 Replace S1 Is safe .

The preconditions are weak , But for the input that meets the preconditions , The post conditions are also weak .

（4） Drawing specifications

The specification defines one of all possible implementation spaces Area . The given implementation either runs according to the specification , The preconditions are met - Implication - Post conditional contract （ It's in the area ）, Or it doesn't meet the specification （ Outside the area ）.

• The implementer is free to move within the specification , Change their code , Don't worry about annoying customers . This can improve the performance of the algorithm for implementers 、 Clarity of the code or changing methods when errors are found are crucial .

• Customers don't know which implementation they will get . They must respect the norms , But they are also free to change the way they use the implementation , Don't worry that it will suddenly break .

（5） Designed specifications

① The specification should be consistent  

A coherent specification is a single for its customers 、 A complete unit makes sense . Specifications should not have many different situations . Long parameter list 、 Boolean flags that enable or disable behavior and complex logic are signs of trouble .

② The returned results should provide information

③ The specification should be strong enough

The specification should give the customer a strong enough guarantee in general —— It needs to meet their basic requirements . When specifying special circumstances , We must be extra careful , To make sure they don't break the methods that would otherwise work .
④ The specification should also be weak enough

Specifications that are too strong sometimes lack important details , If there is a problem, there may be mistakes in many places .

⑤ Specifications should use abstract types whenever possible

Writing our specifications with abstract types gives customers and implementers more freedom . stay Java in , This usually means using interface types , such as Mapor Reader, Not a specific implementation type , such as HashMap or FileReader.

（6） About access control

The decision to make a method public or private is actually a decision about class contracts . Other parts of the program have free access to public methods . Expose a method , Publicize it as the service your class is willing to provide . If you expose all methods —— Include helper methods that are really only used locally in the class —— Then other parts of the program may depend on them , This will make it more difficult for you to change your future classes . Your code will not Prepare for change .

Exposing internal helper methods will also add confusion to the visible interface provided by your class . Keep things inside private Sex makes the public interface of your classes smaller and more coherent （ It means it only does one thing and does it well ）. Your code will Easier to understand .

When we started writing classes with persistent internal state , We will see the use of... In the next few classes The stronger reason for private ownership . Protecting this state will help protect the program Avoid mistakes Influence .

（7） About static methods and instance methods

Static methods are not associated with any particular instance of the class , and example Method （ No static Keyword declaration ） Must be called on a specific object .

The instance method specification is written in the same way as the static method specification , But they usually refer to the properties of the instances that call them .

3、 What I have learned

As usual , Our goal is to design specifications , Make our software ：

• Stay away from mistakes . If there is no specification , Even the smallest changes to any part of our program , It may also be a domino that overturns the whole thing . Well structured 、 Coherent norms can minimize misunderstanding , And maximize our static checks 、 Reason carefully 、 Ability to write correct code with the help of testing and code review .

• Easy to understand . Well written declarative specifications mean that customers don't have to read or understand the code . You may never have read the code , It is right to do so Python It's not as useful for programmers as reading the declaration specification .

• Be ready to change . Moderately weak specifications provide freedom for implementers , A moderately strong specification provides customers with freedom . We can even change the specification ourselves , Without having to revisit every place they use , As long as we just strengthen them ： Weaken preconditions and strengthen postconditions .