1
cs205: engineering software
university of virginia fall 2006
David Evans
www.cs.virginia.edu/cs205
Substitution
Principle
2
cs205: engineering software
How do we know if saying
Bis a subtype of A
is safe?
Substitution Principle: If Bis a
subtype of A, everywhere the code
expects an A, a Bcan be used instead
and the program still satisfies its
specification
3
cs205: engineering software
Subtype Condition 1: Signature Rule
We can use a subtype method where
a supertype methods is expected:
– Subtype must implement all of the
supertype methods
– Argument types must not be more
restrictive
– Result type must be at least as restrictive
– Subtype method must not throw
exceptions that are not subtypes of
exceptions thrown by supertype
4
cs205: engineering software
Signature Rule
class A {
public RAm (PAp) ;
}
class B extends A {
public RBm (PBp) ;
}
RBmust be a subtype of RA: RB<= RA
PBmust be a
super
type of PA: PB>= PA
covariant for results, contravariant for parameters
5
cs205: engineering software
• Precondition of the subtype method
must be weaker than the precondition
of the supertype method.
mA.pre ⇒mB.pre
• Postcondition of the subtype method
must be stronger than the
postcondition of the supertype
method.
mB.post ⇒mA.post
Subtype Condition 2: Methods Rule
6
cs205: engineering software
public int f (a A, x X) {
// REQUIRES: a is initialized
// EFFECTS: returns a.value * x.value
return a.m (x);
}
public class A {
// An A may be initialized or uninitialized.
// An initialized A has an associated int value.
public int m (x X) {
// REQUIRES: this is initialized
}public class B extends A {
// A B may be initialized or uninitialized.
// A B may be awake or asleep.
// An initialized B has an associated int value.
public int m (x X) {
// REQUIRES: this is initialized and awake
}Can’t make the precondition
stronger! The callsite might
not satisfy it.
