Part III — Design and Style on

Chapter 9 — Factoring: Style Becomes Proof

Mon, 01 Jan 0001 00:00:00 +0000

Until you can name it, you cannot check it. Until you can check it, you were only hoping.

— workshop wall

# 9.1 The Practice

The Practice. Factor so each word can be described in one sentence — and so every proof the checker makes attaches to the smallest unit that can carry it. How a program is divided decides where its claims live, and claims that live at interfaces get checked at every call.

Chapter 10 — Decomposition: Information Hiding, Enforced

Mon, 01 Jan 0001 00:00:00 +0000

Hide what might change. Then let the machine check that you hid it.

— workshop wall, after Parnas

# 10.1 The Practice

The Practice. A module is a decision about what might change. Its interface file is the promise the rest of the program is allowed to know, and the checker holds both sides to it: the implementation must match the interface, and callers are checked against the interface — whether or not the implementation exists.

Chapter 11 — Shared State and the Cross-Context Rule: Interrupts

Mon, 01 Jan 0001 00:00:00 +0000

The interrupt arrives in a microsecond. The race it creates ships for a year.

— workshop wall

# 11.1 The Practice

The Practice. Shared hardware is proven, not prayed over: if an interrupt can reach a resource, every access everywhere is inside a lock, the lock lowers to whatever the platform needs, and the handler’s own stack is budgeted at its binding. The race that ships for a year becomes a compile error that ships never.

Chapter 12 — Tasks and Channels: Concurrency the Platform Provides

Mon, 01 Jan 0001 00:00:00 +0000

The scheduler is not in the language. The language is what makes the scheduler safe to use.

— workshop wall

# 12.1 The Practice

The Practice. Concurrency is declared, not assumed: the platform supplies the scheduler, the effects say who may suspend, the annotations say what escapes into it, and every safety property it needs — locks, custody, bounds — is one this book has already paid for.