Conformance of computer programs with predetermined design structures

A computer system for determining whether software code conforms with a predetermined design structure, the computer system comprising:

• means for recording a design control flow graph that represents the intended functionality of a software system, the design control flow graph comprising a plurality of nodes between which transitions occur;
• means for generating source code for a software system, the source code comprising a plurality of software system nodes, wherein the source code includes monitoring functions, wherein each software system node has such a monitoring function and corresponds one-to-one with a respective one of said nodes of said design control flow graph, and wherein the design control flow graph is produced before, or at least independently of the source code to specify intended function and structure of the source code;
• and
• executable program code corresponding to the source code, the executable program code being recorded on a medium readable by the computer system, wherein the computer system is operable to execute the executable program code, the executing proceeding in a sequence such that a first node of the executable program code corresponding to the first one of the software system nodes is exited and a second node of the executable program code corresponding to the second one of the software system nodes is entered from the first node, and wherein the executing includes:
• recording indicia of the exiting from the first node by the executable program code for the monitoring function of the first software system node;
• and
• comparing to the indicia, by the executable program code for the monitoring function of the second software system node, a record of valid predecessor nodes from a predecessor array, wherein if the comparing indicates the first software system node is not a valid predecessor to the second software system node, the executable program code for the monitoring function of the second software system node cleanly terminates the executing and records the entry to the second node from the executable program code's first node as not in conformance with the design control flow graph.

Computer software, recorded on a medium, for determining whether software source code conforms with a predetermined design structure, the computer software comprising:

• software code means for recording a design control flow graph that represents intended functionality of a software system, the design control flow graph comprising a plurality of nodes between which transitions occur;
• software source code for a software system, the source code comprising a plurality of software system nodes, wherein the source code includes monitoring functions, wherein each software system node has such a monitoring function and corresponds one-to-one with a respective one of said nodes of said design control flow graph, and wherein the design control flow graph is produced before, or at least independently of the source code to specify intended function and structure of the source code;
• and
• executable program code corresponding to the source code, wherein executing the executable program code proceeds in a sequence such that a first node of the executable program code corresponding to the first one of the software system nodes is exited and a second node of the executable program code corresponding to the second one of the software system nodes is entered from the first executable node, and wherein the executing includes:
• recording indicia of the exiting from the executable program code's first node by the executable program code for the monitoring function of the first software system node;
• and
• comparing to the indicia, by the executable program code for the monitoring function of the second software system node, a record of valid predecessor nodes from a predecessor array, wherein if the comparing indicates the first software system node is not a valid predecessor to the second software system node, the executable program code for the monitoring function of the second executable node cleanly terminates the executing and records the entry to the executable program code's second node from the executable program code's first node as not in conformance with the design control flow graph.