template\c{\fbox{\ifsli{\tiny}{}implementation}}
class as { int t; T a[MAX]; public: as() { t = 0; } void push(T e) { require(t0); return a[--t]; } invariant: 0 <= t && t < MAX; };
put(i):
require size( b.elems ) < b.bound
promise b′ = 〈 b. elems \uplus {i}, b.bound 〉
push(i):
require length( s.items ) < s.limit
promise s′ = 〈 s.items ·i, s.limit 〉
put(i):and get():Int and assume that the type stack supports the methods get():Int, pop():Int and in addition a method pop():Int that replaces the top element of the stack with its argument. Now, assume that a bag is represented by a pair 〈 elems, bound 〉 , where elems is a multiset (which is a set which may contain multiple elements of the same value) and bound is an integer indicating the maximal number of elements that may be in the bag. Further, we assume that a stack is represented as a pair 〈 items, limit 〉 , where items is a sequence and limit is a the maximal length of the sequence. For example 〈 items, limit 〉 is a legal value of bag and 〈 1 ·2 ·7 ·1, 12 〉 is a legal value of stack. The behavioral constraints for respectively the method put for bag and push for stack are given as pre- and post-conditions in slide 10-ex-subtype. To apply put, we require that the size of the multiset is strictly smaller than the bound and we ensure that the element i is inserted when that pre-condition is satisfied. The multi-set union operator 〈 1 ·2 ·7 ·1, 12 〉 is employed to add the new element to the bag. Similarly, for push we require the length of the sequence to be smaller than the limit of the stack and we then ensure that the element is appended to the sequence. As before, we use the primed variables b′ and s′ to denote the value of respectively the bag b and the stack s after applying the operations, respectively put and push. Proceeding from the characterization of bag and stack we may define the correspondence mapping s′ as in slide 10-ex-correspondence.
require size( b.elems ) < b.bound
promise b′ = 〈 b. elems \uplus {i}, b.bound 〉
push(i):
require length( s.items ) < s.limit
promise s′ = 〈 s.items ·i, s.limit 〉
mk_set( ε ) = ∅
mk_set( e ·s ) = mk_set(s) \uplus {e}
mk_set( ε ) = ∅
mk_set( e ·s ) = mk_set(s) \uplus {e}