<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>There's a simple rule in the world of contract engineering: </div><div><br></div><div>* as a client, demand the strongest possible promise from the serving module </div><div>* as a server, promise as little as you can get away with </div><div><br></div><div>-- Matthias</div><div><br></div><div><br></div><div><br></div><br><div><div>On Oct 4, 2014, at 3:42 PM, Sean Kanaley wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">What do you mean by "weaken" in #3? I presume you mean use a more general type. Is this to allow for flexibility in future iterations? Promising any/c instead of void? ?</div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Oct 4, 2014 at 3:04 PM, Matthias Felleisen <span dir="ltr"><<a href="mailto:matthias@ccs.neu.edu" target="_blank">matthias@ccs.neu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Here is an answer that's not a book but it should be one.<br>
<br>
1. If you write an exported function that looks like this:<br>
<br>
(define (workhorse x)<br>
(validate<br>
validate<br>
validate<br>
validate x ...)<br>
(compute with x ...))<br>
<br>
I recommend that you factor out the validation into a contract:<br>
<br>
(provide<br>
(contract-out<br>
(->i ([x (lambda (x)<br>
(validate<br>
validate<br>
validate<br>
validate x ...))])<br>
...)<br>
<br>
(define (workhorse x)<br>
(compute with x ...)<br>
<br>
It is extremely likely that whoever uses workhorse needs to know about these checks, because they are a part of the interface. Put them there, and only there.<br>
<br>
2. If you are working on a chain of module and except for the top and bottom one, none has contact with the external world, validate values that flow thru the chain once: on the way in or out. Skip checks everywhere else.<br>
<br>
3. For the top and bottom value, write the contracts that you want (for the supplier) and weaken the contract that you promise (the client) and in between trust yourself.<br>
<br>
4. If you have a type system, use it instead of 3. As Neil says, you get some of these checks for free (during compile time) so do them.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Matthias<br>
<br>
<br>
<br>
<br>
<br>
</font></span></blockquote></div><br></div>
</blockquote></div><br></body></html>