The Greybox Approach: When Blackbox Specifications Hide Too Much

Development of different parts of large software systems by separate teams, replacement of individual software parts during maintenance without changing other parts, and marketing of independently developed software components require interface descriptions. Interoperation is impossible without sufficient description; only abstraction leaves room for alternate implementations. Specifications that only relate the state prior to service invocation (precondition) to that after service termination (postcondition) do not sufficiently capture external calls made during operation execution. If other methods called in the specification cannot be fully specified, it is not sufficient that the implementation only performs the specified state transformation. The implementation must also make the prescribed external calls in the respective states. We show how to specify both state change and external call sequences using simple extensions of programming languages. Furthermore, we give a formal definition of the correctness of implementations with respect to such specifications and show how to prove correctness in practice with data refinement in context.