Design-by-Contract

Effective testing involves preparing test oracles and test cases, two activities which are too tedious to be effectively performed by humans, yet for the most part remain manual. The AutoTest unit testing framework automates both, by using Eiffel contracts-already present in the software-as test oracles, and generating objects and routine arguments to exercise all given classes; manual tests can also be added, and all failed test cases are automatically retained for regression testing, in a "minimized" form retaining only the relevant instructions. AutoTest has already detected numerous hitherto unknown bugs in production software.

ABSTRACT Classical views on testing and their associated testing models are not dealing with the question of fault repairing but only focus on fault detection. Diagnosis consists of determining the nature of a detected fault, of locating it and hopefully repairing it. Correlatively, the only standardized quality factors implied in the detection/repair aspects of software engineering are testability and maintainability: those quality factors are misleading since they do not pinpoint this question of the location/repairing effort, that can be identified under the concept of diagnosability. This paper is thus concerned with diagnosability, its definition and the axiomatization of its expected behavior. The paper aims at:•introducing and analysing diagnosability as a significant and complementary dimension of software testability,•producing a high-level definition and axiomatization of a diagnosability measurement generic enough to be adapted to various software paradigms: this property-based approach serves as a measurement “specification”, independent on the application context and thus reusable,•detailing a diagnosability measure dedicated to data-flow software and especially test strategies impact on diagnosis and testing effort (from measure implementation to case study),•illustrating the reuse of the high-level axiomatization to the specific question of measuring the impact of assertions (or contracts for a designed by contract OO system) on diagnosis effort and preciseness.Throughout the paper, the concepts are illustrated on a case study provided by an industrial partner. At last, the reusability of the axiomatization is illustrated by proposing a measure of the impact of assertions (or contracts in a design by contract approach) on global software diagnosability. Main lessons concern both the diagnosability significance as a quality factor and the interest of an axiomatization-based methodology for building trustable software measurement.

Non-functional requirements such as performance, program size, and energy consumption significantly affect the quality of software systems. Small devices like PDAs and mobile phones have little memory, slow processors, and energy constraints. The C programming language has been the choice of many programmers when developing application for small devices. On the other hand, the need for functional software correctness has derived several specification languages that adopt the Design by Contract (DBC) technique. In this work we propose a specification language for C, called CML (C Modeling Language), focused on non-functional requirements. CML is inspired on the Design By Contract technique. An additional contribution is a verification tool for hard real-time systems. The tool is the first application developed for CML. The practical usage of CML is presented through a case study, which is a real application for a vehicle monitoring system.

Object-Z is an object-oriented specification language which extends the Z language with classes, objects, inheritance and polymorphism that can be used to represent the specification of a complex system as collections of objects. There are a number of existing works that mapped Object-Z to C++ and Java programming languages. Since Python and Object-Z share many similarities, both are object-oriented paradigm, support set theory and predicate calculus moreover, Python is a functional programming language which is naturally closer to formal specifications, we propose a mapping from Object-Z specifications to Python code that covers some Object-Z constructs and express its specifications in Python to validate these specifications. The validations are used in the mapping covered preconditions, post-conditions, and invariants that are built using lambda function and Python's decorator. This work has found Python is an excellent language for developing libraries to map Object-Z specif...

Bài báo trình bày những vấn đề về thiết kế theo hợp đồng, kiểm thử đơn vị cũng như những điểm mạnh và những hạn chế của chúng; từ đó đề ra giải pháp kết hợp thiết kế theo hợp đồng và kiểm thử đơn vị. Công cụ csUnit được sử dụng để kiểm thử đơn vị cho các chương trình viết bằng ngôn ngữ C#. Một thư viện được phát triển để hỗ trợ cho thiết kế theo hợp đồng cho các ngôn ngữ .NET. Bài báo đề xuất giải pháp kết hợp hai phương pháp này nhằm nâng cao chất lượng phần mềm hướng đối tượng.

The artifacts of Analysis and Design Methodologies are specified by means of modeling languages. In a relatively short period of time, UML has become the "lingua franca" in software engineering. Metamodeling and abstraction are among the concepts and techniques strongly promoted by UML. The Object Constraint Language, as a textual formalism of UML, plays a key role in understanding and

Web services have received a lot of attention from both researchers and the business IT sector. Most of web service research has been devoted to the issues of standards and supporting technologies. However, despite the considerable volume of research output, the actual application of web services for real business purposes has taken place much more slowly than expected: the number of business web-service-based applications in use is quite low. One of the main reasons for this slow take-up is the lack of research on designing web service applications from a business requirement perspective. Starting from the functional requirements (in terms of use cases), in this paper we propose a systematic method to specify the web service application that is designed to satisfy the functional requirements. The specification unambiguously shows how various parties, who are involved in the application, communicate with each other. Thus, the specifications clearly identify new web services to be built and how the new and existing web services can be composed to provide the required functional behavior. In addition, we also provide a systematic method to validate the specification through prototyping. The specification (which is platform-independent) and the prototype (which is in Java)

The Java Modeling Language (JML) is widely used in academic research as a common language for formal methods tools that work with Java. JML is a design by contract language that can be used to specify detailed designs of Java programs, frameworks, and class libraries. Over twenty research groups worldwide have built several tools for checking code and finding bugs (see jmlspecs.org).

This paper reports on a testing case study applied to a small Java application, partially specified in JML. It illustrates that JML can easily be integrated with classical testing tools based on combinatorial techniques and random generation. It also reveals difficulties to reuse, in a testing context, JML annotations written for a proof process.

The Java Modeling Language (JML) is a behavioral interface specification language (BISL) designed for Java. It was developed to improve functional software correctness of Java applications. However, the JML compiler explores the reflection technique and data structures not supported by Java ME applications. In order to eliminate such a problem, this paper proposes the use of AspectJ to implement a new JML compiler, which generates an instrumented bytecode compliant with both Java SE and Java ME applications. The paper includes a comparative study to demonstrate the quality of the final code generated by our compiler. The size of the code is compared against the code generated by an existent JML compiler. Moreover, we evaluate the amount of additional code required to implement the JML assertions in Java applications. Results indicate that the overhead in the code size produced by our approach is very small, which is essential for Java ME applications.

Statecharts constitute an executable language for modelling event-based reactive systems. The essential complexity of statechart models solicits the need for advanced model testing and validation techniques. In this article we propose a method aimed at enhancing statechart design with a range of techniques that have proven their usefulness to increase the quality and reliability of source code. The method is accompanied by a process that flexibly accommodates testing and validation techniques such as test-driven development, behaviour-driven development, design by contract, and property statecharts that check for violations of behavioural properties during statechart execution. The method is supported by the Sismic tool, an open source statechart interpreter library in Python, that supports all the aforementioned techniques. Based on this tooling, we carry out a controlled user study to evaluate the feasibility, usefulness and adequacy of the proposed techniques for statechart testing and validation.

This paper deals with the modeling, automatic implementation and runtime verification of constraints in component-based applications. Constraints have been assuming an ever more relevant role in modeling distributed systems as long as business rules implementation, design-by-contract practice, and fault-tolerance requirements are concerned. Nevertheless, component developers are not sufficiently supported by existing tools to model and implement such features. In this paper, we propose a methodology and a set of tools that enable developers both to model component constraints and to generate automatically component skeletons that already implement such constraints. The methodology has been extended to support implementation even in case of legacy components.

In the last years, the concern with the correctness of programs has been leading programmers to enrich their programs with annotations following the principles of design-by-contract, in order to be able to guarantee their correct behaviour and to facilitate reuse of verified components without having to reconstruct proofs of correctness. In this paper we adapt the idea of specification-based slicing to the scope of (contract-based) program verification systems and behaviour specification languages. In this direction, we introduce the notion of contract-based slice of a program and show how any specification-based slicing algorithm can be used as the basis for a contract-based slicing algorithm.

is a methodology to construct quality software. DbC associates the contract specification (pre and postconditions of methods of class and class invariant) with the design of a class. In this paper, we combine data flow testing and Design by Contract to develop a testing technique called "Data flow testing using Contract". In this technique a class flow graph is generated from the contract specification of the class and then conventional data flow testing is applied to find the test cases. The advantage of using contract specification is that: it is executable and hence a method in a test case is only executed if its precondition and class invariant are satisfied. If they are not satisfied then it leads to an infeasible sequence. Also, if after executing a method its postcondition is not satisfied then it leads to implementation error in the method. We also compare the testing of a DbC class with a conventional class and find that the number of du pairs is reduced in a DbC class because some of the conditions in conventional class become the part of the precondition in a DbC class.

Object-Z is an object-oriented specification language which extends the Z language with classes, objects, inheritance and polymorphism that can be used to represent the specification of a complex system as collections of objects. There are a number of existing works that mapped Object-Z to C++ and Java programming languages. Since Python and Object-Z share many similarities, both are object-oriented paradigm, support set theory and predicate calculus moreover, Python is a functional programming language which is naturally closer to formal specifications, we propose a mapping from Object-Z specifications to Python code that covers some Object-Z constructs and express its specifications in Python to validate these specifications. The validations are used in the mapping covered preconditions, post-conditions, and invariants that are built using lambda function and Python's decorator. This work has found Python is an excellent language for developing libraries to map Object-Z specifications to Python.

Predicate testing, also known as (branch) condition testing, is most often filed under structural (white box) test case design techniques. Nevertheless, contract-based specification techniques allow for adapting classical predicate testing as a functional (black box) design technique on the class resp. component test level, too. In this paper we discuss various predicate testing coverage criteria known from the literature, adapt them for functional test case design focusing on “design by contract” specifications, and report on a tool supporting both structural and functional predicate coverage testing for Java programs with OCL specifications for invariants and preand postconditions.

Current embedded systems are increasingly more complex and heterogeneous, but they are expected to be more safe, reliable and adaptive. In consideration of all these aspects, their design is always a great challenge. Developing these systems with conventional design approaches and programming methods turns out to be difficult. In this paper, we mainly present the informative background and the general idea of an ongoing yet young research project, including the modelbased design and an architecture-centric approach, to address previous challenges. Our idea adopts a formal-methods-based model integration approach, dedicated to architecture-centric virtual integration for embedded software systems, in an early design phase. We thus expect to improve and enhance Correct By Construction in the design. The considered formal methods consist of timing specification, design by contracts, and semantics interoperability for models to be integrated in the system. The application domains of our approach include automotive and avionic systems.

This paper describes the benefit of incorporating two ideas from Design-by-Contract [3] into the teaching of Cleanroom Software Engineering [4][5], namely the specification of method behavior in terms of inspector methods, and inheritance of method specifications. The inspectors serve as a specification of the transformation between the abstract data type represented by a class and its internal data representation. By inheriting method specifications, the behavior of augmented polymorphic methods can be specified. Pedagogical examples and student code are presented and discussed.

We report on our experiences in teaching lightweight formal methods with Eiffel. In particular, we discuss how we introduce formal methods via Eiffel's design-by-contract and agent technologies, and how we integrate these techniques with test-driven development, in an approach called specification-driven design. This approach demonstrates how formal methods techniques fit with industrial software engineering practice.

Architecture description languages (ADLs) are used to specify high-level, compositional views of a software application. ADL research focuses on software composed of prefabricated parts, so-called software components. ADLs usually come equipped with rigorous state-transition style semantics, facilitating verification and analysis of specifications. Consequently, ADLs are well suited to configuring distributed and event-based systems. However, additional expressive power is required for the description of enterprise software architectures -in particular, those built upon newer middleware, such as implementations of Java's EJB specification, or Microsoft's COM+/.NET. The enterprise requires distributed software solutions that are scalable, business-oriented and mission-critical. We can make progress toward attaining these qualities at various stages of the software development process. In particular, progress at the architectural level can be leveraged through use of an ADL that incorporates trust and dependability analysis. Also, current industry approaches to enterprise development do not address several important architectural design issues. The TrustME ADL is designed to meet these requirements, through combining approaches to software architecture specification with rigorous design-by-contract ideas. In this paper, we focus on several aspects of TrustME that facilitate specification and analysis of middlewarebased architectures for trusted enterprise computing systems.

The literature for deductive formal verification is quite rich; however, very few case studies have been done. The authors present a case study of using deductive formal verification of a navigation system from the avionics domain. Both writing the specifications and their verification with a runtime assertion checker and KeY, a tool using automatic theorem proving techniques for verifying Java programs, are covered.

Considerable progress has been made towards automatic support for one of the principal techniques available to enhance program reliability: equipping programs with extensive contracts. The results of current contract inference tools are still often unsatisfactory in practice, especially for programmers who already apply some kind of basic Design by Contract discipline, since the inferred contracts tend to be simple assertions-the very ones that programmers find easy to write. We present new, completely automatic inference techniques and a supporting tool, which take advantage of the presence of simple programmer-written contracts in the code to infer sophisticated assertions, involving for example implication and universal quantification.

Design by contract is a practical methodology for evolving code together with its specification. The contract has important methodological implications on the design of the program. In addition, tools that instrument the code to check for contract violations help the development process by catching errors close to their sources. This is complicated by several factors, such as the need to collect preconditions from supertypes. There are two issues involved in the implementation of such a tool: the correct enforcement of the theoretical principles, and the instrumentation of the code. Most previous tools tackle both issues, but have subtle failures in one or the other. This paper describes Jose, a tool for design by contract in Java, which uses As-pectJ, an aspect-oriented extension of Java, to instrument the program. This allows us to leverage the expertise of the AspectJ developers in instrumenting Java programs, and concentrate on the correct implementation of the designby-contract principles. This approach has the added benefit that it can be generalized to other object-oriented languages that have aspect-oriented extensions. We describe the design decisions made in the implementation of Jose, and the features of AspectJ that helped or hindered this implementation.

Testing is commonly used to check conformance in contract-based programs, as verification by formal proofs is hard to scale and static analysis is, sometimes, limited for detecting general nonconformances. Traditional test cases, with manually-provided data, may be ineffective in detecting subtle nonconformances that arise only after several instantiations and modifications in objects under test. Those nonconformances may signalize more subtle bugs, hindering the benefits of using contract-based programs. Random-generated tests with automatic test data generation, on the other hand, is a promising approach when more substantial testing is demanded. In this work, we propose and evaluate an approach, JMLOK 2.0, for automatically detecting and categorizing nonconformances, in the context of Java Modeling Language (JML). Our approach aims to help the programmer in the process of nonconformances correction. The detection is backed by Randomly-Generated Tests (RGT) approach. And the categorization is backed by heuristics-based approach. We perform two evaluations. First, we perform an evaluation of our detection approach and our manual categorization process: we detected 84 nonconformances in over 29 KLOC and 9 K lines of JML contracts (that we will refer as KLJML henceforth); applying our manual classification system we got that most detected nonconformances were classified as postcondition errors; we also observed that a nonconformance is detected after 2.54 top-level test case calls, in average, and the number of internal calls within the faulty test case call is an average of 2.23, providing evidence for the need of a more complex generated test structure in nonconformance detection; furthermore, we compare our approach with JET, an existing test-based approach for detecting nonconformances in JML programs, using a subset of programs from first study (6 KLOC and 5 KLJML). JMLOK 2.0 detected 30 nonconformances with Java coverage of 78.44% and JML coverage of 67.67%, while JET detected 9 nonconformances by covering 47.97% of Java and 56.97% of JML. Second, we perform an evaluation of our automatic categorization approach: we compare automatic and manual categorization and got a matches value of 0.73 (considering the nonconformances from first evaluation) indicating similarity between automatic and manual approaches; furthermore, we compare our results with the categorization performed by voluntary JML experts and we also observed some similarity.

Increasing effort in development of high quality distributed systems requires ground methodological base. Design by Contract approach looks very promising as a candidate since it helps to obtain component-wise specification and design, to separate concerns between developers, and makes development of high quality complex systems a manageable process. Unfortunately, in its classic form it can hardly be applied to distributed network applications because of lack of adequate means to describe asynchronous events. We extend Design by Contract with capabilities to describe callbacks and asynchronous communication between components and apply it to specify distributed software and to develop conformance test suites in automated manner. Specifications are developed in extensions of programming languages that makes them clear for industrial developers and decreases test construction effort. Practical results of numerous successful applications of the method are described.

This paper deals with the modeling and the automatic implementation of constraints in component based applications. Constraints have been assuming an ever more relevant role in modeling distributed systems as long as business rules implementation, design-by-contract practice, and fault-tolerance requirements are concerned. Nevertheless, component developers are not sufficiently supported by existing tools to model and implement such features. In this paper, we propose a set of tools that enable developers both to model component constraints and to automatically generate component skeletons that already implement such constraints.

ESpec is a suite of tools that facilitates the testing and veriflcation of object-oriented Eifiel programs in an integrated environment. The suite includes unit testing tools (ES-Test) and Fit tables (ES-Fit for customer requirements) that report contract failures. This paper describes ES-Verify (part of ESpec) for automatically verifying a signiflcant subset of Eifiel constructs written with a value semantics. The

TIBO derivatives, as non-nucleoside reverse transcriptase inhibitors, have gained a definitive place in the treatment of HIV-1 infections. Some new TIBO-like derivatives have been designed by contraction of the b-ring (diazepine ring) of TIBO derivatives from seven to 6-membered ring. The autodock program was used to study the binding of the molecules to HIV-1 the reverse transcriptase enzyme. A total of 16 TIBO derivatives were examined. The results showed that both the 7 and 6-membered ring compounds could dock into the enzyme. A linear relationship was obtained between the total free energy of docking and pIC 50 of the conventional TIBO derivatives. The total free energy of docking indicated that some of these derivatives were bonded to the receptor stronger than the 7-membered derivatives. Meanwhile, in comparison with 8-Cl TIBO molecule, which is currently used in the HIV treatment, one 6-membered ring derivative showed more binding affinity toward the reverse transcriptase enzyme. q Journal of Molecular Structure: THEOCHEM 732 39-45 www.elsevier.com/locate/theochem 0166-1280/$ -see front matter q

Las capacidades conversacionales de un agente pedagógico (la personi cación del entrenador) permiten una interacción social con los aprendices; luego, su aplicación en entornos virtuales 3D para el entrenamiento permite mejorar esta interacción y da mayor realismo al entrenamiento virtual, permitiendo cambios en las estrategias de tutorías que acercan la experiencia virtual a una real. Scaffolding emerge del trabajo de famosos educadores como un paradigma instruccional y cada vez se utiliza más en aplicaciones educativas soportadas por computadores. Por supuesto, la aplicación de scaffolding en entornos virtuales de entrenamiento es muy diferente de su concepción original y de su aplicación en la sala de clases. Las características de los entornos virtuales, la personi cación del agente pedagógico y sus posibilidades de interacción virtual con el alumno hacen posible la utilización de esta estrategia caracterizada, entre otras cosas, por su adaptación al rendimiento del aprendiz y su utilización dinámica de las herramientas disponibles. Este artículo presenta las ventajas de utilizar scaffolding en entornos virtuales de entrenamiento como estrategia de tutoría para agentes pedagógicos, centrándose en las características claves de scaffolding y en cómo éstas pueden ser aplicadas en las actividades del agente pedagógico. Para modelar la estrategia, se utiliza la Teoría de la Actividad, así como los roles y objetos de aprendizaje reutilizables diseñados por contrato. Finalmente, se presenta una propuesta para aplicar scaffolding como estrategia de tutoría para agentes pedagógicos en entornos virtuales de entrenamiento utilizando el denominado "Modelo para la Aplicación de Entornos Virtuales Inteligentes a la Formación".

The Java Modeling Language (JML) is a behavioral interface specification language (BISL) designed for Java. It was developed with the aim of improving the functional software correctness of Java applications. The JML compiler (jmlc) generates bytecodes that use the Java reflection mechanism and data structures not supported by Java ME applications. In order to overcome this limitation, we propose the use of AspectJ to implement a new JML compiler, which generates an instrumented bytecode compliant with both Java SE and Java ME applications. The paper also includes a comparative study to demonstrate the quality of the final code generated by our compiler. Results indicate that the overhead in code size produced by our compiler is very small, which is essential for Java ME applications.

It is claimed in the literature that the contracts of a system present crosscutting structure during its realization. In this context, there has been attempts to improve separation of crosscutting contracts, e.g. by aspect-oriented programming and design by contract languages, but none give programmers textual separation of contracts/specifications and modular reasoning at the same time.

Assertions are a basic programming ingredient. If the language you use does not support them in a proper way, at least you must use some kind of standardized comments, to express things like preconditions for functions. The comments can be turned into executable functions by a preprocessor, but we could write the function calls directly, with the advantage of having the compiler check their syntax. This technique can be used with C++, to emulate the full set of assertions used in Eiffel to implement Design by Contract. The assertion functions are grouped in a class, class Assertions, which is inherited by the classes whose functions we want to assert. The assertions can be turned on and off object by object, during the execution of the program. The system works well under inheritance, although some guidelines must be followed when writing postconditions on the base class. The simplicity of this mechanism makes it possible to comment out all or some of the assertions automatically, through the programming environment.

Learning object design by contract is a proposal for formalization of learning object metadata in order to enhance the design of Web-based educational contents by augmenting their reusability. It basically consists of a formal notation that allows stating, in the form of declarations called contracts, the conditions under which a learning object can be used and the outcomes that might be expected from its use. Contracts become a very beneficial instrument when new educational resources are automatically generated from combining ...

Sulu is a programming language designed with automated unit testing specifically in mind. One aim of Sulu is to demonstrate how automated software testing can be more integrated into current software development processes. Sulu's runtime and tools support automated testing from end to end; automating the generation, execution, and evaluation of test suites using both code coverage and mutation analysis. To show the effectiveness of this integrated approach, we performed an experiment to evaluate a family of test suites generated using a test case generation algorithm which exhaustively enumerates every sequence of method calls within a certain bound. The results show high code coverage, including 90% statement coverage and high mutation coverage for the most comprehensive test suite generated.

The Java Modeling Language (JML) is a behavioral interface specification language (BISL) designed for Java. It was developed with the aim of improving the functional software correctness of Java applications. The JML compiler (jmlc) generates bytecodes that use the Java reflection mechanism and data structures not supported by Java ME applications. In order to overcome this limitation, we propose the use of AspectJ to implement a new JML compiler, which generates an instrumented bytecode compliant with both Java SE and Java ME applications. The paper also includes a comparative study to demonstrate the quality of the final code generated by our compiler. Results indicate that the overhead in code size produced by our compiler is very small, which is essential for Java ME applications.

Non-functional requirements such as performance, program size, and energy consumption significantly affect the quality of software systems. Small devices like PDAs and mobile phones have little memory, slow processors, and energy constraints. The C programming language has been the choice of many programmers when developing application for small devices. On the other hand, the need for functional software correctness has derived several specification languages that adopt the Design by Contract (DBC) technique. In this work we propose a specification language for C, called CML (C Modeling Language), focused on non-functional requirements. CML is inspired on the Design By Contract technique. An additional contribution is a verification tool for hard real-time systems. The tool is the first application developed for CML. The practical usage of CML is presented through a case study, which is a real application for a vehicle monitoring system.

Aspect oriented programming is a way of reducing the complexity of software development, in the sense that it is easier to reason about isolated concepts. The complexity of web applications has been increasing in the last few years, mainly, because customers are requesting more and more. We think that advanced separation of concerns can be a good strategy to reduce the complexity of web applications. In order to pool the drawbacks and strengths of aspect oriented technology for web development, we have developed the same application, on the one hand, using AspectJ and Java Server Pages (JSP), and, on the other hand, using Cocoon, a web framework based on XML for publishing web pages. While developing the application, a few concerns brought up, but we are going to focus this paper on two of them, authentication and design by contract, because they help us give a clearer explanation of our results.

Assertions or formal program specifications are fundamental to build more reliable software. One of the most important applications of assertions is found in the Design by Contract metaphor: pre-conditions, invariants and postconditions. Current assertion approaches use some software technology that relies on simple mechanisms; however their actual implementation can be both quite complex and instrusive. A good knowledge of program algorithms is required to introduce enhancements which crosscut basic algorithms and structures. In this paper, we propose a nonintrusive assertion verification implementation. We have used aspect-orientation and provide correctness in order to decide on the validity of assertions.

We present an approach for testing Java implementations of abstract data types (ADTs) against their specifications. The key idea is to reduce this problem to the run-time monitoring of contract annotated classes, which is supported today by several runtime assertion-checking tools. The approach comprises an ADT specification language that allows automatic generation of monitorable contracts and a refinement language that supports the specification of the details of object-oriented implementations of ADTs. design time implementation time Specification Module T

... Index Terms—Object-oriented design methods, programming by contract, diagnostics, metrics. Ç 1 INTRODUCTION SEVERAL works advocate the use of assertions to improve software quality [1], [2], [3], [4], [5], but very few are actually interested in measuring this improvement. ...

Abstract Design by contract is the principle that the interfaces between modules of a software system-especially a mission-critical one-should be governed by precise specifications. The contracts cover mutual obligations (pre-conditions), benefits (post-conditions), and consistency constraints (invariants). Together, these properties are known as assertions, and are directly supported in some design and programming languages. A recent $500 million software error provides a sobering reminder that this principle is not ...