SWE/CS 332 In Class Exercise #11

Today's in-class exercise is verifying the Members example:
public class Members {
    // Members is a mutable record of organization membership
    // AF: ??
    // rep-inv: ??

    List<Person> members;   // the representation

    //  Post: person becomes a member
    public void join (Person person) { members.add   (person);}

    //  Post: person is no longer a member
    public void leave(Person person) { members.remove(person);}

  1. Develop a suitable Abstraction Function. Illustrate your Abstraction Function with several representation-state/abstract-state pairs.

  2. There are two obvious choices for the rep-invariant. What are they?

  3. What does verifying the join() method have to do with verifying the leave() method?

  4. Verify join() with the first rep-invariant.

  5. Verify leave() with the first rep-invariant.

  6. Fix whatever is broken and re-verify.

  7. Repeat the prior 3 steps for the second rep-invariant

  8. Is it meaningful to verify a method without choosing a rep-invariant?