System and method for software module architecture language and compliance checking

[0001] This application claims the benefit of U.S. Provisional Application No. 60/408,697, filed Sep. 5, 2002 and claims the benefit of U.S. Provisional Patent Application Ser. No. 60/450,839, filed Feb. 28, 2003.

[0002] A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.

[0003] The invention relates generally to systems for software development, and particularly to a system and method for determining and supporting dependencies between objects or modules in a software development project.

[0004] A complex software project or software system may include multiple modules, components, or objects, each of which may relate to one another in some manner. Of particular importance are those relations in which a module (or component, object, etc.) depends on another module for some functionality. This creates a dependency by one module on the other, or between the modules. If the independent module is changed, then care must be taken that the dependent module is similarly changed, or will not fail in some way because of the change. For ease of development, modules may also be grouped and developed in layers, or as subsystems of a larger, more complex system. However, popular programming languages such as the JAVA™ programming language cannot express dependencies and module architecture relations such as layers and subsystems. These relations inherently span multiple modules (i.e. packages in the JAVA™ programming language) and hence they cannot be captured within the programming language's concepts. What is needed is a more formalized approach to managing relations and dependencies between software modules to ensure better compliance with the overall software architecture.

[0005] Disclosed herein is a system and method for module architecture specification that allows developers to maintain and control the module dependency structure of their products in a pragmatic, cost effective way over the long lifetime of large-scale, development and maintenance projects. As described herein, an embodiment of the system referred to as “IDARWIN” includes a specification language together with a set of tools that check software code, for example JAVA™ programming language source-code and class files, for adherence to a set of specifications. Unlike the use of “module architecture diagrams” (the typical picture of layered software) which are highly ambiguous, an IDARWIN module architecture specification is precise and can be checked automatically. If the code deviates from the desired structure, developers are alerted without delay and can either revise the module architecture description, or remove non compliant code dependencies. IDARWIN is thus a cost effective early warning system that helps to stop a particularly expensive form of code-aging.

[0006] Load-time linking in the JAVA™ programming language makes the issue of “dependency creep” particularly acute. While one can maintain layer- or subsystem-dependencies using build systems such as “make” or “ant” by carefully controlling the class path that is presented to the compiler runs for each subsystem, in practice this is done very rarely, since it is tedious and hard to adapt. As a result, a lower layer in a system can unintentionally start to depend on a higher layer due to a code-change. In accordance with one embodiment IDARWIN determines static dependencies among classes and interfaces in JAVA™ programming language source- and class-files. Next it reads a set of module architecture specification files which it composes into a single compound specification, and then checks each code dependency against the compound specification to find:

• [0007] the code dependencies that violate the module architecture;
• [0008] the code dependencies that evade coverage by statements in the specification;
• [0009] redundant and obsolete specification statements.

[0010] An important feature of the invention is the ability to present multiple specifications to IDARWIN, so as to allow both subsystem and layer “owners”, i.e. the developers of these components, to author their own specifications from their individual perspective. These alternate views will sometimes overlap and in these cases IDARWIN contains a sophisticated mechanism to detect and resolve contradictory specification statements.

[0022] Disclosed herein is a system and method for module architecture specification that allows developers to maintain and control the module dependency structure of their products in a pragmatic, cost effective way over the long lifetime of large-scale, development and maintenance projects. As described herein, an embodiment of the system referred to as “IDARWIN” includes a specification language together with a set of tools that check JAVA™ programming language source-code and class files for adherence to a set of specifications. Unlike “module architecture diagrams” which are highly ambiguous, an IDARWIN module architecture specification is precise and can be checked automatically. If the code deviates from the desired structure, developers are alerted without delay and can either revise the module architecture description, or remove non compliant code dependencies. IDARWIN is thus a cost effective early warning system that helps to stop a particularly expensive form of code-aging.

[0023] Load-time linking in the JAVA™ programming language makes the issue of “dependency creep” particularly acute. While one can maintain layer- or subsystem-dependencies using build systems such as “make” or “ant” by carefully controlling the class path that is presented to the compiler runs for each subsystem, in practice this is done very rarely, since it is tedious and hard to adapt. As a result, a lower layer in a system can unintentionally start to depend on a higher layer due to a code-change. In accordance with one embodiment IDARWIN determines static dependencies among classes and interfaces in JAVA™ programming language source- and class-files. Next it reads a set of module architecture specification files which it composes into a single compound specification, and then checks each code dependency against the compound specification to find:

• [0024] the code dependencies that violate the module architecture;
• [0025] the code dependencies that evade coverage by statements in the specification;
• [0026] redundant and obsolete specification statements.

[0027] An important feature is the ability to present multiple specifications to IDARWIN, so as to allow both subsystem and layer “owners”, i.e. the developers of these components, to author their own specifications from their individual perspective. These alternate views will sometimes overlap and in these cases IDARWIN contains a sophisticated mechanism to detect and resolve contradictory specification statements.

[0028] In practice, the IDARWIN system in accordance with one embodiment of the invention may be used to provide a software development environment by which software developers (programmers, architects, etc.) can formulate rules that are to be followed during the development of a “software project”, i.e. a typically complex multi-module, multi-component, or multi-object software application. Particularly, these rules can be defined so as to allow, forbid, or constrain certain dependencies between software objects within the project. On a larger scale, the system can be used to allow, forbid, or constrain certain dependencies between software modules, or between the building blocks of large enterprise systems (essentially a larger scale “software project”). When the software project or enterprise system is built, for example at compile-time, the dependencies can be checked and verified against the rules. This serves as a positive check on the consistency of dependencies within the software project according to predefined architecture design/rules, and also allows a system architect or quality assurance (QA) team to identify any dependencies that may contravene those rules. A decision may then be made as to whether to, for example, change the rules, or eliminate the errant dependency.

[0029] FIG. 1 illustrates an example 100 of the type of software project or enterprise level system that may benefit from the use of the invention. As shown in FIG. 1, a software project may include various modules, such as RMI 104, EJB 108, and JMS 112 modules, each of which may be under the control of an individual software developer or development team. During compilation, (which in fast-moving businesses with lots of builds can take place every 60 minutes or so), dependencies between the software modules can be identified, and in accordance with an embodiment of the invention, checked 114 against a set of rules 116. Some rules 112 may specifically allow certain dependencies between the modules. Other rules 120, 122, 124 may specifically deny or forbid other such dependencies. Oftentimes the individual rules may be contradictory in what they allow or forbid, and require clarification. The set of rules themselves can be gathered from multiple sources, checked for consistencies, and sorted or rewritten for efficiency. In this way, each of the software modules can be independently developed with less concern that the calls they either make to other modules, or allow from other modules, will contravene the architecture rules laid down for the development of the entire software project or system. This allows large-scale projects to be developed by many different software developers or development teams, each perhaps with their own style and way of programming, while ensuring a consistency among the dependencies within the project. The result is a faster and more efficient development time, coupled with a more consistent and bug-free end product.

[0030] FIG. 2 illustrates an alternate embodiment in which the compliance-checking system in accordance with the invention is used on an enterprise platform level to monitor dependencies between software components within a large scale system 140. Some components, such as a Web Integration Module 142, a Web Services module 144, a Portal module 146, and the like, may be defined by the rules as for example not being allowed to rely (i.e. are forbidden 158, 160 from relying) on other components for certain operations, i.e. they must operate independently as standalone components. Other rules may allow one component to talk to another component, for example a server module 152, via a public interface (API) 156. Using a rules-based module architecture checking system as described herein ensures that when the individual components are shipped to the marketplace, there is less chance that they will fail later because of an undiscovered dependency problem.

[0031] The following section presents a simple module architecture specification with LAYER and ISOLATE statements. Subsequent sections describe the core language features, such as rules and patterns, as well as how rules are composed and checked against dependencies extracted from the code; the central notion of “rule contradiction”; extended-language statements, such as LAYER and ISOLATE; the meaning of extended-language statements and how they are desugared into core-language rules and patterns; and additional embodiments and conclusions.

[0032] FIG. 3 shows a flowchart of a process in accordance with an embodiment of the invention illustrating how the IDARWIN system is used to assist a developer in maintaining consistency of their code. As shown in FIG. 3, in step 170, a developer or development team develops code for a software module, object, or other software component. In step 172, the developer is allowed to define a specification for their particular module, or for a group of modules. The specification defines any dependencies or restrictions that should preferably be associated with their module, for example dependencies on other modules, isolations, or layering. In step 174 the specification is associated with the module, object, etc. for later use by IDARWIN. Steps 176, 178 and 180 are performed by the IDARWIN system. Typically, steps 176 and 178 are performed each time the specification for a module is changed, while steps 176, 178 and 180 are performed any time the module's code is changed together with the specification. In step 176 a set of specifications is parsed and all extended-language statements are expanded (desugared) in each specification into a set of core-language rules and patterns. In step 178, the set of all core-language rules and patterns is checked for contradictions, and if no unresolved contradiction is found, the rules are ordered by “specificness”, and the ordered set is simplified. In step 180, all dependencies are read and each is checked for compliance with the ordered rules. In step 182, the results of the IDARWIN analysis of the code and associated specification, including the presence of incompliant dependencies, is output or saved for later review by the developer.

Simple Example

[0033] FIG. 4 shows an example specification groundrules 170 which illustrates some of the language constructs available to describe a desired module architecture. The specification starts with some abbreviations for patterns (lines 4–11) which are then used in the context of the ISOLATE, LAYER and ALLOW statements. IDARWIN is a purely declarative language, hence the order of the architecture statements is irrelevant. In this example the ISOLATE statement prevents any dependencies among types that match its argument patterns. The LAYER statement prevents lower layers from referring to upper layers. The ALLOW statement declares an exception to the above statements.

[0034] Assume the code checked against this specification contains the type com.rsys.cluster.Cluster, which depends on com.rsys.jms.Destination. This dependency is flagged as a violation of the LAYER statement at line 22, because the Cluster type is part of the backplane pattern (line 5), whereas the Destination type is part of the jms pattern (line 9). The LAYER statement prevents such upward dependency. The precise meaning of the LAYER and ISOLATE statement is defined in later sections.

[0035] The need for some exceptions to the groundrules often arises. Generally speaking, the groundrules should apply to all subsystems of a project, but some specific pair of subsystems may need to allow for a few, well-known dependencies that violate the groundrules. For example, assume the ejb subsystem needs to refer to a type in the jms subsystem. As shown in FIG. 4, line 27 allows for such an exception by specifically stating that every type in package com.rsys.ejb20.mdb may refer to com.rsys.jms.QueueImpl. This ALLOW statement is a refinement of the coarser ISOLATE statement at line 16 and IDARWIN automatically determines that the ALLOW statement takes precedence. If a rule violation is found, an error report 180 is printed, such as that shown in FIG. 5. If a groundrule is unsuitable in the context of a specific layer or subsystem, then the owner of that subsystem can override the groundrules within their realm.

Module Architecture Specification

[0036] The IDARWIN is based on a core language of two basic elements. The central concepts are the pattern, which is used to capture a set of class-, interface- and package-names, and two kinds of rules. Macro style core language extensions provide the user with convenient abstractions, such as the concept of layers and isolation. A subsystem may consist of many packages, and one might want to exclude certain subpackages. A pattern captures such configurations. The pattern language is limited (i.e. no regular expressions) for two reasons:

• [0037] 1. the notion of rule ordering and rule contradiction, which is central to IDARWIN's ability to compose independently authored specifications, relies on the existence of an ordering relation between rules. Such an ordering relation requires the pattern language to be limited so as to only allow wildcards at the end of the pattern. In practice this is to not a limiting factor.
• [0038] 2. it makes the language closer to the familiar JAVA™ programming language import patterns.

[0039] As illustrated in FIG. 3 above, IDARWIN operates in three steps. Steps one and two only have to be performed if the specification changed, while step three must be run whenever the code changed.

• [0040] 1. parse a set of specifications and expand (desugar) all extended-language statements in each specification into a set of core-language rules and patterns
• [0041] 2. check the set of all core-language rules and patterns for contradictions, and if no unresolved contradiction is found, order the rules by “specificness” and simplify the ordered set of rules
• [0042] 3. reads all dependencies and checks each for compliance with the ordered rules.
  Core Language

[0043] The core language is made up of three atomic and two compound patterns as well as two kinds of rules. Atomic patterns are either fully qualified class and interface names (called “name patterns”), or wildcard patterns (called “children” and “descendent patterns”). Compound patterns combine patterns by forming their union and difference. The syntax of patterns is:

• [0044] a fully qualified class-and interface-name is an atomic, name pattern, e.g. java.lang.Object.
• [0045] p.* is an atomic, descendent pattern, e.g. java.lang.*, where p is the package of the pattern (java.lang)
• [0046] p.# is an atomic, children pattern, e.g. java.lang.#, where p is the package of the pattern (java.lang). p.# only matches with names in package p, but not with any subpackages.
• [0047] the sum of two patterns (p+q) is a compound, union pattern, e.g. java.lang.*+java.util.List
• [0048] the difference of two patterns (p−q) is a compound, difference pattern, e.g. java.lang.*−java.lang.Object

[0049] Definitions 1–6 shown below capture the notion of pattern “matching” and pattern “subsumption”. An atomic name pattern a “matches” a pattern p (atomic or compound), and is written as a ≦p p. A pattern p “subsumes” a pattern q, and is written a ≦p q. The meaning (written as [[e]]) of the ≦p pattern relation is given in terms of familiar set theory, Boolean logic and the string prefix ≦relation. P denotes the set of all package name strings, and C denotes the set of all class and interface names. The variables r, s and t denote atomic and compound patterns. A denotes an atomic patterns. N and M as well as p and q denote a string. The ≦p relation, +, − as well as .* and .# are part of the core language alphabet.

[0050] The intuitive meaning of the ≦p relation is based on the interpretation of patterns as sets of strings (where the strings are class and interface names).

[0051] $\begin{array}{cc}\begin{array}{ccc}〚r{\le }_{p}s〛& \stackrel{\mathrm{def}}{=}& 〚r〛\subseteq 〚s〛\end{array}& \left(1\right)\\ \begin{array}{ccc}〚r+s〛& \stackrel{\mathrm{def}}{=}& 〚r〛\bigcup 〚s〛\end{array}& \left(2\right)\\ \begin{array}{ccc}〚r-s〛& \stackrel{\mathrm{def}}{=}& 〚r〛\backslash 〚s〛\end{array}& \left(3\right)\\ \begin{array}{ccc}〚p.N〛& \stackrel{\mathrm{def}}{=}& \left\{p.N\right\}\end{array}& \left(4\right)\\ \begin{array}{ccc}〚p.\#〛& \stackrel{\mathrm{def}}{=}& \left\{p.M|M\in C\right\}\end{array}& \left(5\right)\\ \begin{array}{ccc}〚p.*〛& \stackrel{\mathrm{def}}{=}& \{q.Mp⪯q⩓q\in P⩓M\in C\}\end{array}& \left(6\right)\end{array}$

[0052] IDARWIN uses the following syntactic rewrite rules to evaluate pattern “matching” (definitions 11, 14, 17) and “pattern subsumption” (definitions 7–19). Here [[e]] reduces the relation e to terms involving the ≦(string prefix) and ≐(string equal) relation over strings and Boolean logic.

[0053] $\begin{array}{cc}\begin{array}{ccc}〚r{\le }_{p}s+t〛& \stackrel{\mathrm{def}}{=}& 〚r{\le }_{p}s〛⩔〚r{\le }_{p}t〛\end{array}& \left(7\right)\\ \begin{array}{ccc}〚r{\le }_{p}s-1〛& \stackrel{\mathrm{def}}{=}& 〚r{\le }_{p}s〛⩓⫬〚r{\le }_{p}t〛\end{array}& \left(8\right)\\ \begin{array}{ccc}〚r+s{\le }_{p}a〛& \stackrel{\mathrm{def}}{=}& 〚r{\le }_{p}a〛⩓〚s{\le }_{p}a〛\end{array}& \left(9\right)\\ \begin{array}{ccc}〚r-s{\le }_{p}a〛& \stackrel{\mathrm{def}}{=}& 〚r{\le }_{p}a〛\end{array}& \left(10\right)\\ \begin{array}{ccc}〚p.N{\le }_{p}q.M〛& \stackrel{\mathrm{def}}{=}& 〚p\doteq q〛⩓〚N\doteq M〛\end{array}& \left(11\right)\\ \begin{array}{ccc}〚p.\#{\le }_{p}q.M〛& \stackrel{\mathrm{def}}{=}& \mathrm{false}\end{array}& \left(12\right)\\ \begin{array}{ccc}〚p.*{\le }_{p}q.M〛& \stackrel{\mathrm{def}}{=}& \mathrm{false}\end{array}& \left(13\right)\\ \begin{array}{ccc}〚p.N{\le }_{p}q.\#〛& \stackrel{\mathrm{def}}{=}& 〚q⪯p〛\end{array}& \left(14\right)\\ \begin{array}{ccc}〚p.\#{\le }_{p}q.\#〛& \stackrel{\mathrm{def}}{=}& 〚p\doteq q〛\end{array}& \left(15\right)\\ \begin{array}{ccc}〚p.*{\le }_{p}q.\#〛& \stackrel{\mathrm{def}}{=}& \mathrm{false}\end{array}& \left(16\right)\\ \begin{array}{ccc}〚p.N{\le }_{p}q.*〛& \stackrel{\mathrm{def}}{=}& 〚q⪯p〛\end{array}& \left(17\right)\\ \begin{array}{ccc}〚p.\#{\le }_{p}q.*〛& \stackrel{\mathrm{def}}{=}& 〚q⪯p〛\end{array}& \left(18\right)\\ \begin{array}{ccc}〚p.*{\le }_{p}q.*〛& \stackrel{\mathrm{def}}{=}& 〚p\doteq q〛\end{array}& \left(19\right)\end{array}$
Rules

[0054] A dependency is defined as a pair of fully qualified class-or interface-names (atomic name patterns), e.g. (java.util.Iterator, java.lang.Object). The core language of IDARWIN contains two kinds of rules, the (ALLOW p, q) and the (PREVENT p, q) rule. Both take two patterns as arguments. Shown below the dependency match relation (≦d) between a dependency and a rule is defined using the previously defined pattern match relation between a patterns (≦p). Here a and b are atomic name patterns, p and q are patterns (atomic or compound).

[0055] $\begin{array}{ccc}\left(a,b\right){\le }_d\left(\mathrm{PREVENT}p,q\right)& \stackrel{\mathrm{def}}{=}& a{\le }_{p}p⩓b{\le }_{p}q\end{array}$ $\begin{array}{ccc}\left(a,b\right){\le }_d\left(\mathrm{ALLOW}p,q\right)& \stackrel{\mathrm{def}}{=}& a{\le }_{p}p⩓b{\le }_{p}q\end{array}$
For example:

[0056]

	•(java.util.Iterator, java.lang.object) ≦d
	(ALLOW java.util.* java.*)
	•(java.util.Iterator, java.lang.object)
	d (PREVENT java.lang.* java.*)

Rule Precedence

[0057] The notion of rule precedence is central to the ability to allow users to specify many independent specifications and then compose them. During processing IDARWIN orders the rules, so that the most specific rule is checked first, and hence dominates a less specific rule. This allows for the intuitive notion of “rule X is an exception to the general rule Y”. Using the previously defined inclusion relation between patterns, it is possible to define what it means for a rule to be equal to or more specific than another rule.

[0058] $\begin{array}{ccc}\left(\mathrm{PREVENT}p,q\right){\le }_r\left(\mathrm{PREVENT}r,s\right)& \stackrel{\mathrm{def}}{=}& p{\le }_{p}r⩓q{\le }_{p}s\end{array}$ $\begin{array}{ccc}\left(\mathrm{ALLOW}p,q\right){\le }_r\left(\mathrm{ALLOW}r,s\right)& \stackrel{\mathrm{def}}{=}& p{\le }_{p}r⩓q{\le }_{p}s\end{array}$ $\begin{array}{ccc}\left(\mathrm{PREVENT}p,q\right){\le }_r\left(\mathrm{ALLOW}r,s\right)& \stackrel{\mathrm{def}}{=}& p{\le }_{p}r⩓q{\le }_{p}s\end{array}$ $\begin{array}{ccc}\left(\mathrm{ALLOW}p,q\right){\le }_r\left(\mathrm{PREVENT}r,s\right)& \stackrel{\mathrm{def}}{=}& p{\le }_{p}r⩓q{\le }_{p}s\end{array}$
For example:

[0059]

	•(ALLOW java.util.* java.lang.*) ≦r
	(ALLOW java.util.* java.*)
	•(ALLOW java.util.jar.* java.lang.*) ≦r
	(ALLOW java.util.* java.*)
	•(ALLOW java.* java.lang.*) r (ALLOW
	java.util.* java.*)
	•(ALLOW java.* java.*) r (ALLOW
	org.apache.* java.*)

[0060] A set of rules can now be sorted using the above relation. For example, assume we have a set that contains (PREVENT java.util.* java.lang.*),(ALLOW java.util.jar.JarFile java.lang.Object) and (PREVENT * java.*), the sorting would lead to the following order, where the most specific rule comes first:

• [0061] 1.(ALLOW java.util.jar.JarFile java.lang.Object)
• [0062] 2.(PREVENT java.util.* java.lang.*)
• [0063] 3.(PREVENT * java.*)
  Later we will see that IDARWIN will remove the second rule as an optimization since it is subsumed by the third rule, since they are of the same polarity.
  Rule Simplification

[0064] We define the polarity π(r) of a rule r as:

[0065] $\begin{array}{ccc}\pi \left(\mathrm{ALLOW}p,q\right)& \stackrel{\mathrm{def}}{=}& \mathrm{True}\end{array}$ $\begin{array}{ccc}\pi \left(\mathrm{PREVENT}p,q\right)& \stackrel{\mathrm{def}}{=}& \mathrm{False}\end{array}$
Polarity is a simple way to determine the “type” of a rule (it is ALLOW or PREVENT). The notion of polarity is used to define two performance related simplifications:

• [0066] A rule r is dropped, if it immediately precedes another rule s and r ≦r s and π(r)=π(s). Duplicate rules are removed as a special case. For example, if the ordered set of rules is: (ALLOW foo.* bar.*) followed by (ALLOW * bar.*), then the former rule will be removed because it's subsumed by the latter and both are of the same polarity. If the set is however (ALLOW foo.* bar.boo.*), (PREVENT * bar.boo.*) followed by (ALLOW * bar.*), then the first rule can not be eliminated since it's not immediately followed by a rule of the same polarity.
• [0067] Two rules r and S are merged, if they immediate follow each other, are of the same polarity π(r)=π(s) and are of the form: (ALLOW a b), (ALLOW a c). Then the merged rule will be (ALLOW a b+c). If possible the first argument to ALLOW will be merged symmetrically. The same applies to the PREVENT rule.
  Rule Contradiction

[0068] There is a catch to the ordering defined above. For example if we have the following two rules: (PREVENT com.foo.* *) and (ALLOW * java.*), their order is undefined since neither is a subset of the other:

[0069]

	•(PREVENT com.foo.* *) r (ALLOW * java.*),
	since com.foo.* ≦p *, but * p java.*
	•(ALLOW * java.*) r (PREVENT com.foo.* *),
	since * p com.foo.*, despite java.* ≦p *

Since the two rules have different polarity (one is an ALLOW rule, while the other is a PREVENT rule), the fact that the order among them is undefined leads to an ambiguous result when a dependency is checked against them. For example, the dependency (com.foo.Bar, java.lang.Object) matches both rules, so depending on which rule is checked first, the dependency triggers an ALLOW or a PREVENT action. In the latter case the dependency will be marked as a specification violation, whereas in the former case the dependency would be accepted as specification compliant. The above rules leave it unclear whether a dependency that matches (ALLOW com.foo.* java.*) and (PREVENT com.foo.* java.*) should be accepted or rejected since both rules apply. Such ambiguity is clearly unacceptable.

[0070] FIG. 6 illustrates the problem. When the source 200 and the target 204 of the first rule 208 (rule 1, r1) are both subsets, respectively, of the source 210 and the target 214 of the second rule 218 (rule 2, r2), then there is no problem, since the first rule can be totally included within (more appropriately is more specific than) the second rule. The first rule then gains precedence over the second rule. However, when either the source 230 or the target 234 of the first rule 236 is NOT a subset, respectively, of the source 240 and the target 244 of the second rule 248, then there may be a problem, since the first rule cannot be totally included within (is not more specific than) the second rule. Nor can the second rule be totally included within the first rule (since it's no more specific either). This is when a possible contradiction arises.

[0071] A simple way to avoid the above contradiction is to rewrite the rules slightly and state, for example: (PREVENT com.foo.* (*-java.*)) and (ALLOW * java.*). Now the two rules do not conflict anymore since any dependency that matches the first rule won't match the second and vice versa, since (*-java.*) and java.* are disjoint. The notion of contradiction defined below will take this into account.

[0072] In accordance with one embodiment of the invention, a specification is defined to be inconsistent if there is at least one pair of rules that contradict each other. Later we will refine this definition to allow for the ability to explicitly resolve contradictions by either supplementing a “resolverrule”, or by annotating contradicting rules with precedence levels.

[0073] If two rules a and b contradict each other, we write a{circle around (×)}b, where {circle around (×)} is defined below. Assuming that the patterns p, q, r and s are not union pattens:

[0074] $\begin{array}{ccc}\left(\mathrm{PREVENT}p,q\right)\otimes \left(\mathrm{ALLOW}r,s\right)& \stackrel{\mathrm{def}}{=}& p=r⩓q=s\end{array}\begin{array}{cc}⩔& \left(p{<}_{p}r⩓s{<}_{p}q\right)\end{array}\begin{array}{ccc}& ⩔& (r{<}_{p}p⩓q{<}_{p}s\end{array}))\begin{array}{ccc}\left(\mathrm{ALLOW}p,q\right)\otimes \left(\mathrm{PREVENT}r,s\right)& \stackrel{\mathrm{def}}{=}& p=r⩓q=s\end{array}\begin{array}{cc}⩔& \left(p{<}_{p}r⩓s{<}_{p}q\right)\end{array}\begin{array}{ccc}& ⩔& (r{<}_{p}p⩓q{<}_{p}s\end{array}))$ $\begin{array}{ccc}\left(\mathrm{PREVENT}p,q\right)\otimes \left(\mathrm{PREVENT}r,s\right)& \stackrel{\mathrm{def}}{=}& \mathrm{False}\end{array}$ $\begin{array}{ccc}\left(\mathrm{ALLOW}p,q\right)\otimes \left(\mathrm{ALLOW}r,s\right)& \stackrel{\mathrm{def}}{=}& \mathrm{False}\end{array}$
If the rules contain union patterns, they must be split:

[0075] $\left(\mathrm{PREVENT}\left(t+u\right),q\right)\otimes \left(\mathrm{ALLOW}r,s\right)\stackrel{\mathrm{def}}{=}\left(\mathrm{PREVENT}t,q\right)\otimes \left(\mathrm{ALLOW}r,s\right)\bigvee \left(\mathrm{PREVENT}u,q\right)\otimes \left(\mathrm{ALLOW}r,s\right)$ $\left(\mathrm{PREVENT}p,\left(t+u\right)\right)\otimes \left(\mathrm{ALLOW}r,s\right)\stackrel{\mathrm{def}}{=}\left(\mathrm{PREVENT}p,t\right)\otimes \left(\mathrm{ALLOW}r,s\right)\bigvee \left(\mathrm{PREVENT}p,u\right)\otimes \left(\mathrm{ALLOW}r,s\right)$
Example contradictions

• [0076] (PREVENT * *)(ALLOW * *)
• [0077] (PREVENT com.foo.* *)(ALLOW * java.*)
  These are not contradictions
• [0078] (PREVENT com.foo.* *-java.*) does not contradict (ALLOW * java.*), because java.* (*-java) and (*-java.*) java.*, i.e. the two patterns are disjoint.
• [0079] (PREVENT com.foo.* *) does not contradict (ALLOW com.foo.* java.*), since the latter is simply a refinement of the former rule.
  Rule Contradiction Resolution

[0080] There are two ways to resolve rule contradictions:

• [0081] The user may provide additional resolver rules that are included for the expressed purpose of clarifying the specification. In the above example, where (PREVENT com.foo.* *) and (ALLOW * java.*) contradict each other, either of the following two rules resolves the contradiction by clarifying the polarity for the overlapping patterns: (ALLOW com.foo.* java.*) or (PREVENT com.foo.* java.*).
• [0082] The user may annotate the specification statements (and thus the desugared core language rules) with explicit precedence levels (integers, where a higher number dominates over a lower number). The user can tag either of the contradicting rules (PREVENT com.foo.* *) or (ALLOW * java.*) with a precedence annotation. For example (PREC 1 ALLOW * java.*) and (PREVENT com.foo.* *)do not contradict (the default precedence level is 0).

[0083] During operation, the IDARWIN systems desugars a module architecture specification into a set of rules S. If the rules are consistent, we order them using the ≦r relation, to create an ordered set of rules O. The set of rules are now ready to be applied and checked against each dependency presented to the tool.

[0084] If the rules are inconsistent (i.e. there is at least one contradicting pair of rules), a few intermediate steps must be taken to arrive at O. First, the rules involved in contradictions (call this set of pairs of rules C) are determined by pair wise checking all rules in S. For example, after desugaring extended language statements into core language rules we may have the unordered set of rules S 270 as shown in FIG. 7.

[0085]

	IDARWIN will find three contradictions (C contains
	these three pairs) hence the specification is inconsistent:
	1. C1 = (ALLOW * java.*) (PREVENT com.foo.*
	*)
	2. C2 = (PREVENT com.foo.bar.* com.boo.*)
	(ALLOW * com.boo.boo.*)
	3. C3 = ((PREVENT com.foo.* *) (ALLOW *
	com.boo.boo.*)

[0086] Next, for each contradiction (a pair (p, q) of rules) in C, the set S\{p, q} is searched for a contradiction resolver. A rule r resolves a contradiction (p, q)εC (two rules contradicting each other), if and only if r<_rp^ (AND) r<_rq, meaning r is more specific than both p and q. A resolved contradiction is removed from C, the resolver rules is added to the set of resolvers R and removed from S. This process is repeated until all resolver rules are found.

[0087] In the above example, shown in FIG. 7, the rules at line 12 and 13 resolve the contradictions C₂ and C₃ respectively.

[0088] Now we have the three sets: the resolvers R, the remaining contradictions that were not resolved C−R, and the rules that do not contradict each other minus the resolvers that were moved to R, S−C−R.

[0089] The user can annotate each rule that is involved in a contradiction with a precedence level (during desugaring this precedence level is passed on). The remaining unresolved contradicting rules in C−R are ordered by precedence. If the user gave no precedence to the rules, IDARWIN exits with an error reporting the contradictions remain unsolved.

[0090] In the above example, shown in FIG. 7, the rule at line 3 and 4 resolves the contradiction C₁ by specifically giving the (ALLOW * java.*) precedence. All contradictions are thus resolved.

[0091] Now, we form the union O=R+o_p(C−R)+o_≦r(S−C−R), where o_p means ordered by precedence annotation and o_≦r means ordered by rule specificness.

[0092] The toolkit's verbose mode 280, as illustrated for example in FIG. 8, displays the above reasoning steps to the user. The rules are checked in this order (O set):

• [0093] 1.ALLOW (com.foo.bar.*) (com.boo.boo.*)[prec0]
• [0094] 2.PREVENT (com.foo.*) (com.boo.boo.*) [prec 0]
• [0095] 3.ALLOW (*) TO (java.*) [prec 1]
• [0096] 4.ALLOW (com.foo.*) TO (com.foo.*) [prec 0]
• [0097] 5.PREVENT (com.foo.*) TO (*) [prec 0]
• [0098] 6.ALLOW (*) TO (com.boo.boo.*) [prec 0]

[0099] Rule precedence is only invoked for rules that are involved in a contradiction. Therefore rule precedence annotations cannot be used to control the order of rule evaluation. In the above example, rule 3 has precedence 1, which lets it dominate rule 5.

Rule Checking Process

[0100] Assuming the system has a consistent set of rules O (all existing contradictions resolved through the above process), then a dependency d is checked against the rules following these steps.

• [0101] 1. iterate through all rules O until a rule r is found that matches the dependency d, d≦_dr.
• [0102] 2. if no rule matches the dependency, then the dependency is accepted and adheres to the specification. A warning is issued to state that the dependency is not covered by the specification prompting the user to complement the specification with a statement about the dependency specifically, or the packages involved. This is an important software development tool in order to keep module specifications up to date with code-structure changes (e.g. a new library is used, that is not mentioned in any rule yet).
• [0103] 3. if a rule matches d and it's polarity π(r)=True then the dependency is accepted and adheres to the specification. The rule r is added to the set of used rules U.
• [0104] 4. if a rule matches and it's polarity π(r)=False then the dependency is rejected and IDARWIN prints an error report stating that the dependency d violates rule r and does not adhere to the specification. The rule r is added to the set of used rules U.

[0105] After all dependencies have been presented to IDARWIN, all rules that were not used (i.e. the set of O–U), can be printed, so that the user can update the specification and remove potentially outdated rules. This is an important tool to keep the specification in sync with code changes (e.g. a library is not longer used in the code, so all rules that refer to this library can be detected and purged).

[0106] In practice, the set of rules may be under the control of an individual software developer or development team. During compilation, dependencies between the software modules can be identified, and in accordance with an embodiment of the invention, checked against a set of rules. As shown in FIG. 9, the total set of rules 302 themselves can be gathered from multiple sources 292, 294, 296 to form 298 a set of combined rules 290, checked for consistencies, and sorted or rewritten for efficiency, to form a single, consistent, sorted ruleset 302 that is then used as an automatic part of the compilation process to produce the report such as is shown in FIG. 8 above. In this way, each of the software modules can be independently developed with less concern that the calls they either make to other modules, or allow from other modules, or objects will contravene the architecture rules laid down for the development of the entire software project or system. When a rule, and a proposed change to the code seem to both be reasonable alternatives, a system architect may have the final say as to which one should trump the other. Then either the code, or the rules must be updated to reflect that decision.

Extended Language Constructs

[0107] In accordance with an embodiment of the invention, the IDARWIN module architecture specification language offers the user additional constructs in addition to the core language rules. As shown below, p and q can be patterns or names bound to patterns. Some additional statements include:

• [0108] ALLOW p TO q
• [0109] PREVENT p TO q
• [0110] LAYER p ABOVE q ABOVE r . . .
• [0111] STRICTLYLAYER p ABOVE q ABOVE r . . .
• [0112] ISOLATE p FROM q FROM r . . .
• [0113] BOTTOM p, q, . . .
• [0114] TOP p, q, . . .
• [0115] HIDE p OUTSIDE q, where p≦_rq

[0116] To aid the structuring of large specifications, patterns can be bound to a name, so as to allow them to be reused. Bindings can be exported and imported to allow sharing of pattern definitions among specification files, for example:

• [0117] LET n=p IN statement or let . . . END
• [0118] EXPORT n
• [0119] IMPORT b FROM n AS b0

[0120] To facilitate the IMPORT feature, specifications must be named, hence the first statement in any specification must be “DSPEC name IS . . . ”. Any top-level binding exported from specification name can be imported in another specification. In the example 310 shown in FIG. 10, the renaming feature of the import statement is used to avoid name clashes. All bindings are resolved and substituted before the desugaring of statements into core language rules. Hence the core language does not need to know about bindings, LET, EXPORT and IMPORT.

Desugaring Into Core Language Rules and Patterns

[0121] The meaning of each statement type of the extended language is described in further detail below by describing how that statement type is desugared into core language rules and patterns.

[0122] The ALLOW and PREVENT statement are passed on to the core language unchanged, except for the resolution of bindings into patterns. For example the lib binding in ALLOW com.foo.* TO lib statement in the above example is resolved and the core-language rule results.

[0123]

	ALLOW com.foo.* ((((com.rsys.common.*)
	+antlr.*)
	+java.*)
	+com.apache.*)

Layer and Strictlylayer

[0124] LAYER and STRICTLYLAYER take an ordered list of patterns as arguments. The patterns capture the layers of the module-architecture stack. The first pattern is assumed to be the top of the layering stack, the last element is at the bottom. LAYER p ABOVE q ABOVE r will be rewritten into three core language PREVENT rules: PREVENT r q, PREVENT r p and PREVENT q p. These three rules prevent any “upward” pointing dependencies, ensuring that lower layers do not depend on any of the layers above them.

[0125] In the STRICTLYLAYER case, an additional 4th rule is generated: PREVENT p r. This rule ensures that layers can only depend on the layer immediately below them and cannot depend on any layer further down.

[0126] Note that LAYER and STRICLTYLAYER do not imply that there's no other pieces of software above and below the top and bottom layer-element, as the pictorial representation of layers does. To capture this, the TOP and BOTTOM statements can be used (described below), which are then composed with the LAYER and STRICTLYLAYER statements.

Isolate

[0127] ISOLATE takes a set of patterns, where each patterns might for example represent a subsystem. ISOLATE p FROM q FROM r will be rewrite into six core language PREVENT rules that prevent each pair or patterns to refer to each other: PREVENT r q, PREVENT r p, PREVENT q r, PREVENT q r, PREVENT p r, PREVENT p q.

[0128] Interestingly ISOLATE p FROM q FROM r can be implemented as a combination of LAYER statements. Write ISOLATE [p, q, r] as ISOLATE I, then desugar ISOLATE I=(desugar LAYER I) U (desugar LAYER reverse I).

Bottom and Top

[0129] The TOP and BOTTOM statements take a pattern and are rewritten into two core language rules. TOP p is desugared into PREVENT * p and ALLOW p p. BOTTOM p is desugared into PREVENT p * and ALLOW p p.

[0130] The purpose of TOP p is to express the fact that p is at the very top of the module hierarchy and no other module (other than p), itself should refer to p. The purpose of BOTTOM p is analogous to express the fact that p is at the very bottom of the module hierarchy and must itself not refer to any other module (except itself). BOTTOM is most useful to make sure a library is tagged as such.

[0131] BOTTOM p is a stronger statement than LAYER . . . ABOVE p, since the latter only prevents dependencies from p into upper-layers that are named in the LAYER statement, whereas the BOTTOM statement prevents p from depending on any code other than itself.

[0132] TOP p is not implied by LAYER p ABOVE . . . . Both are needed to capture the meaning of the familiar (but ambiguous) graphical layered diagrams.

Hide

[0133] HIDE p OUTSIDE q requires p≦_rq and is used to hide “internal” packages. For example: HIDE com.foo.internal.* OUTSIDE com.foo.* will make sure that no dependency from e.g. com.bar.* can reach into the internal package com.foo.internal.*. Only com.foo and it's subpackages (including com.foo.internal) are allowed to depended on the internal package.

[0134] HIDE p OUTSIDE q is desugared into a single core language rule: PREVENT (*-q) p. For example HIDE com.foo.internal.* OUTSIDE com.foo.* results in the rule PREVENT PREVENT (*-com.foo.*) com.foo.internal.*.

[0135] FIG. 11 illustrates one example of how the LAYER and ISOLATE features can be used to constrain a layering architecture in a software project or enterprise system. The LAYER feature allows layers, such as a library layer 320, backplane layer 322, and connector layer 324, to be logically created as a layering stack. The ISOLATE feature can be used to isolate subsystems, such as JCA (JAVA™ CONNECTOR ARCHITECTURE) 326, EJB (ENTERPRISE JAVA™ BEAN) 328, Webapp 330, and JMS (JAVA™ MESSAGING SYSTEM) 332 subsystems within, for example, a specific layer such as the J2EE (JAVA™ 2 ENTERPRISE EDITION) connector layer shown.

Additional Embodiments

[0136] Additional embodiments fall into two categories—improving the toolkit and extending the specification language. Once a specification is written for a subsystem, it tends to be relatively stable and to change slowly compared to the changes to the code itself. Hence one option is to separate the specification processing steps (“specification compiler” tool) from the code-dependency checking step (“compliance checker”). Specialized compliance checkers will be written—one for commandline use, and others that integrate tightly with popular IDEs, ideally reading their internal “code dependency” representations directly.

[0137] Another option is the use of generic statements. Experience shows that the HIDE p OUTSIDE q statement in particular is often used in a similar way for multiple subsystems. The particular idiom states that “internal” types in a subsystem shall not be referred to from the “outside” of the subsystem. Rather than repeating such a conventions for each subsystem, the overall specification may be clearer and more maintainable if one expresses the above idiom with a single rule, such as

• [0138] . . .
• [0139] GENERIC HIDE com.foo.subsystem.*.internal.*
• [0140] OUTSIDE com.foo.subsystem.*
• [0141] WHERE subsystem MATCHES #
• [0142] . . .

[0143] To instantiate generic statements IDARWIN needs to find the package names that match the most specific pattern in the generic statement. For example, the package of class com.foo.ejb.internal. A would match the generic statement pattern (the # pattern matches the dotless ejb), leading to an instantiation of the specific statement, substituting ejb for subsystem. The most specific pattern is used to instantiate the generic statement, so that no specific, obsolete (don't match any dependency) statements are generated.

[0144] To implement generic statements, IDARWIN needs access to the package structure of a project to instantiate specific rules. One embodiment of the current system performs this via two passes over the code-dependencies. The first pass, just after the specification-parsing phase, reads all dependencies and finds all package names that match a generic statement, instantiating additional specific statements. IDARWIN reads the code-dependencies a second time to check them against the core-language rules.

[0145] Reading the code-dependencies to find all package names in order to instantiate generic rules is at odds with the aim of separating the “specification compilation” phase from the “compliance checking” phase because now the former would need to know the actual dependencies that will be checked in the second phase. This is only an issue for a commandline “batch” version of the system. An IDE version of IDARWIN is able to notice changes to the package structure of a project, without having to see all code-dependencies through IDE callbacks in the even of package additions, renaming and deletion.

[0146] The IDARWIN system in accordance with an embodiment of the invention provides a module architecture specification language, and a toolkit to check code for specification compliance. The specification language allows for the safe composition of independently authored specifications, by automatically detecting contradictory statements and by ordering the statements by “specificness”. As a result developers and architects can structure large specifications into “structural concerns” that each focus on overall-groundrules and subsystems. They can adapt specification fragments without the danger of unintentionally affecting the meaning of other specification sections. The specification language successfully strikes a balance between expressiveness and effort to learn. Users may pick up the language instantly, and the specification language is able to capture real world module architectures of large systems. IDARWIN is designed to be used in a fast moving development environment, where frequent code structure improvements through refactoring require a lightweight specification language. In particular, module architecture specifications can be used to:

• [0147] express the intent of an ongoing refactoring project, where they allow progress to become visible at a high level of abstraction;
• [0148] capture the rationale behind a module architecture and package naming conventions in a concise way, so that new team-members grasp the “groundrules” of a project quickly and so that the structure does not deteriorate over time (“dependency creep”);
• [0149] experiment with different module structures by “overlaying” improved candidate structures on existing code. New code-modules can be defined using union and difference-patterns, without having to alter existing code.

[0150] The present invention may be conveniently implemented using a conventional general purpose or a specialized digital computer or microprocessor programmed according to the teachings of the present disclosure. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software art.

[0151] In some embodiments, the present invention includes a computer program product which is a storage medium (media) having instructions stored thereon/in which can be used to program a computer to perform any of the processes of the present invention. The storage medium can include, but is not limited to, any type of disk including floppy disks, optical discs, DVD, CD-ROMs, microdrive, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data.

[0152] The foregoing description of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to the practitioner skilled in the art. Particularly, it will be evident that while embodiments of the invention have been described herein with respect to a J2EE application server or WebLogic™ environment, that embodiments and implementations may also be used with other application servers, and with other computing environments. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling others skilled in the art to understand the invention for various embodiments and with various modifications that are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the following claims and their equivalence.