Self-checking against formal specifications

The authors use an algebraic technique of formally specifying a module that implements an abstract data type, with a C/sup ++/ implementation. An explicit mapping from implementation states to abstract values is added to the C/sup ++/ code. The form of specification allows mechanical checking of desirable properties such as consistency and completeness, particularly when operations are added incrementally to the data type. During unit testing, the specification serves as a test oracle. Any variance between computed and specified values is automatically detected. When the module is made part of some application, the checking can be removed, or may remain in place for further validating the implementation. The specification, executed by rewriting, can be thought of as itself an implementation with maximum design diversity, and the validation as a form of multiversion-programming comparison.<
>