Pipa: A Behavioral Interface Specification Language for AspectJ

1
Pipa A Behavioral Interface Specification
Language for AspectJ

• By
• Jianjun Zhao and Martin Rinard

2
Introduction

• Aspect-oriented programming has been proposed as
  a technique for improving the separation of
  concerns in software design and implementation.
• AOP provides explicit mechanisms for capturing
  the structure of crosscutting aspects of the
  computation.
• AOP can eliminate the code tangling associated
  with standard languages.

3
Introduction

• AOP introduces new concepts (join points, advice,
  introduction) and aspects.
• Needs formal specification and verification.

4
Pipa

• Behavioral interface specification language
  (BISL) tailored to AspectJ.
• Describes both the details of a modules
  interface with clients and its behavior from the
  clients point of view.
• Simple and practical extension to JML

5
Goal

• To develop a transformation tool that
  automatically transforms AspectJ and Pipa
  specifications into corresponding Java program
  and JML specification.
• Use JML-based checking and verification tools to
  directly check and verify AspectJ programs.

6
Design Rationale

• Pipa as a compatible extension to JML
• Facilitates JML users adoption
• Facilitate the adoption of JML-based tools to
  check AOP
• Why is JML appropriate?
• AspectJ is a seamless extension to Java for
  implementing crosscutting concerns
• JML has efficient tool support for both static
  and dynamic checking of Java programs

7
Design Rationale

• Legal JML specification for Java should be legal
  Pipa specification for AspectJ
• Pipa should feel like a natural extension JML
• Extend JML-based tools to support Pipa
• Pipa specifications should be strongly connected
  to the AspectJ code

8
JML

• Formal BISL tailored to Java.
• JML allows assertions to be specified for Java
  classes and interfaces.
• Support specification-only model fields.
• JML predicates are written using regular Java
  expressions extended with logical operators and
  universal and existential quantifiers
• Supports specification inheritance

9
JML

• Provides class-level specifications with
  additional clauses such as invariant, constraint,
  and model.
• Model - allows the declaration of so called model
  variables which are variables that exist only
  within a specification.
• Invariant - declares properties that are true in
  all publicly, visible, reachable states of an
  object.
• Constraint is used to specify how values may
  change between earlier and later states.

10
Aspect Specifications

• Advice Specifications
• Before
• After
• Around
• Introduction Specifications
• Aspect Invariants

11
Aspect Specifications

• Aspect is a modular unit for implementing
  crosscutting concerns.
• Pointcuts and advice support the implementation
  of crosscutting aspects.
• Pipa uses module-level specifications to specify
  the behavior of individual modules such as
  advice, introduction, and methods in an aspect.
• Pipa uses aspect-level specifications to specify
  the global properties of the aspect as a whole.

12
Advice Specifications

• Defines pieces of code in an aspect that should
  be executed when a pointcut is reached during the
  execution of a program.
• AspectJ provides three kinds
• Before
• After
• Around

13
Advice Specifications

• Dynamically changes the behavior of a class
  (behavioral crosscutting)
• Advice Specification Preconditions,
  Postconditions and frame conditions
• Requires
• Ensures
• Modifies

14
Advice Specifications

• Preconditions
• is an assertion that states the properties that
  must hold before the control flow is transferred
  into the advice.
• Postconditions
• is an assertion that states the properties that
  the advices must establish before the control
  flow returns to the advised method.

15
Before Advice

• Executes when a join point is reached and before
  the computation proceeds.
• In Pipa, the behavior before advice can be
  specified by a precondition, a postcondition, and
  a frame condition.

16
Before Advice Example
17
After Advice

• Executes after the computation under the join
  point terminates.
• AspectJ supports three kinds of after advice
• After
• After-returning
• After-throwing
• In Pipa, the behavior after advice can be
  specified by a precondition, a postcondition, and
  a frame condition.

18
After Advice Example
19
Around Advice

• Executes when a join point is reached, and has
  explicit control over whether the computation
  under the join point us allowed to execute at
  all.
• Pipa uses the proceeds predicate clause to state
  that when control flow proceeds to the original
  method body the around advice must make
  predicate hold.

20
Around Advice

• Pipa also uses advice into two parts
• before part, which is the portion of the
  specification corresponding to the around advice
  before proceeding to the original method,
• after part which is the portion corresponding to
  the around advice after returning from the
  original method but before returning to the
  original caller.

21
Around Advice
22
Introduction Specifications

• AspectJ provides a form called introduction that
  can operate over the static structure of type
  hierarchies.
• Used to add new fields, constructors, or methods
  into given classes or interfaces.

23
Introduction Specifications
24
Aspect Invariants

• Aspect invariants express global semantic or
  integrity properties for the aspect
• Informally, an invariant of an aspect is a set of
  assertions that each instance of the aspect will
  satisfy at all times when the state is observable.

25
Aspect Invariants
26
Aspect Specification Inheritance and Crosscutting

• Specification Inheritance
• An aspect can only extend an abstract aspect not
  a concrete aspect
• An aspect can extend a class
• An aspect can implement any number of interfaces

27
Aspect Specification Inheritance and Crosscutting

• A subaspect inherits the specifications of its
  superaspect's public and protected members as
  well as the public and protected aspect
  invariants.
• A subaspect inherits the specifications of its
  superclass's public and protected members as
  well as the public and protected class
  invariants.
• A subaspect inherits the specifications of its
  superinterface's public and protected members
  (fields and methods), as well as the public and
  protected interface invariants.

28
Aspect Specification Inheritance and Crosscutting

• Specification Crosscutting Rules
• The specification of an aspect's advice crosscuts
  the specifications of those classes' methods that
  the advice crosscuts (behavioral crosscutting).
• The specification of an aspect's introduction
  crosscuts the specifications of those classes
  that the introduction crosscuts (structural
  crosscutting).

29
Transforming Pipa Specifications Back to JML

• Use JML-based tools
• Transformation to Java and JML
• Problems
• Handle aspect invariants by weaving the aspect
  invariant into the class invariant of every class
  that the aspect crosscuts
• Handle the problem of specification weaving when
  weaving the aspects into classes.

30
Conclusion

• Pipa is the first BISL tailored to AspectJ that
  can be used to specify AspectJ programs.
• Simple and practical extension to JML
• Supports specification inheritance and
  crosscutting.

31
Future Work

• Support more kinds of join points (cflow
  cflowbelow)
• Refine specification framework for AspectJ
• Implement a tool to automatically transform an
  AspectJ program with Pipa specifications to
  corresponding Java program with JML specification

32
Questions?