Spec Sharp
Spec# is a programming language with specification language features that extends the capabilities of the C# programming language with Eiffel-like contracts, including object invariants, preconditions and postconditions. Like ESC/Java, it includes a static checking tool based on a theorem prover that is able to statically verify many of these invariants. It also includes a variety of other minor extensions to the language, such as non-null reference types.
| Paradigm | multi-paradigm: structured, imperative, object-oriented, event-driven, functional, contract |
|---|---|
| Designed by | Microsoft Research |
| Developer | Microsoft Research |
| First appeared | 2004 |
| Stable release | SpecSharp 2011-10-03
/ October 7, 2011 |
| Typing discipline | static, strong, safe, nominative |
| License | Microsoft Research Shared Source license agreement (MSR-SSLA) |
| Website | research |
| Influenced by | |
| C#, Eiffel | |
| Influenced | |
| Sing# | |
The code contracts API in the .NET Framework 4.0 has evolved with Spec#.
Microsoft Research developed both Spec# and C#; in turn, Spec# serves as the foundation of the Sing# programming language, which Microsoft Research also developed.
Features
- See also: Spec# in C Sharp syntax.
Spec# extends the core C# programming language with features such as:
- Non-nullable types
- Structures for code contract like preconditions and postconditions.
- Checked exceptions similar to those in Java.
- Convenient syntax
Example
This example shows two of the basic structures that are used when adding contracts to your code (try Spec# in your browser).
static int Main(string![] args)
requires args.Length > 0;
ensures return == 0;
{
foreach(string arg in args)
{
Console.WriteLine(arg);
}
return 0;
}
- ! is used to make a reference type non-nullable, e.g. you cannot set the value to null. This in contrast of nullable types which allows value types to be set as null.
- requires indicates a precondition that must be followed in the code. In this case the length of args is not allowed to be zero or less.
- ensures indicates a postcondition that must be followed in the code.
Sing Sharp
Sing# is a superset of Spec#. Microsoft Research developed Spec#, and later extended it into Sing# in order to develop the Singularity operating system. Sing# augments the capabilities of Spec# with support for channels and low-level programming language constructs, which are necessary for implementing system software. Sing# is type-safe. The semantics of message-passing primitives in Sing# are defined by formal and written contracts.
Sources
- Barnett, M., K. R. M. Leino, W. Schulte, "The Spec# Programming System: An Overview." Proceedings of Construction and Analysis of Safe, Secure and Interoperable Smart Devices (CASSIS), Marseilles. Springer-Verlag, 2004.