Split Capabilities: Making Capabilities Scale

[Karp, Alan]

> -----Original Message-----
> From: Mark S. Miller [mailto:markm@caplet.com]
> Sent: Monday, July 31, 2000 10:43 AM
> To: Karp, Alan
> Cc: 'Jonathan S. Shapiro'; 'Ralph Hartley'; e-lang@eros-os.org
> Subject: RE: Split Capabilities: Making Capabilities Scale
> 
> 
> At 10:32 AM 7/31/00 , Karp, Alan wrote:
> >Would not the object's state transition diagram suffice?
> 
> You can't draw a state transition *diagram* of even the 
> incr/decr example, 
> as (waiving finite memory limits) it has as many states as 
> there are integers.
> 
> 
>          Cheers,
>          --MarkM
> 

We're allowed to use symbolic notation in our state transition diagrams,
aren't we?  Pardon the poor notation.

		construct(int x): x<=0; exception; X = x
					
		decrement() X:=X-1

			X==0: BlastOff(); destruct()(object, not rocket)
				
I believe that this contract says that I construct the instance with an
integer greater than zero.  Each invocation of decrement decreases the
hidden value by unity.  When the hidden value reaches zero, something
happens, and the object destroys itself.
				
_________________________
Alan Karp
Decision Technology Department
Hewlett-Packard Laboratories MS 1U-2
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-6278