Following Parnas [], we define a module as a programming work assignment, and a module interface (hereafter just interface) as the set of assumptions that programmers using the module are permitted to make about its behavior. An interface specification is a statement, in some form, of these assumptions. We view a module as a black box, accessible only through a fixed set of access routines. The syntax of the specification states the names of the access routines, their parameter and return value types, and the names of the exceptions that each access routine may generate. The semantics of the specification state, for each access routine call, the situations in which the call is legal, and the effect that invoking the call has on the legality and return values of other calls. The module implementation is required to detect the occurrence of an illegal call and to signal the module user that the associated exception has occurred. A trace is a sequence of access routine calls. By convention, in access routine names we use the prefix s_ (set) to indicate calls that set internal module values and g_ (get) to indicate calls that retrieve those values.
To illustrate these ideas, we introduce the Symbol Table ( symtbl) module, which maintains a set of symbol/location pairs. The interface syntax of the module is shown in Table 1;
Table 1: symtbl module interface
we explain the semantics informally below.
The table can store up to MAXSYMS pairs, and each symbol
can be up to MAXSYMLEN characters in length.
s_init initializes the module to an empty table and must be called
before any other call.
s_add(s,x) adds the symbol/location pair 
to the table, signaling the exception maxlen if s is longer
than MAXSYMLEN characters, exsym if s is already in the
table, and full if there are MAXSYMS pairs in the table.
g_siz returns the number of pairs in the table.
g_exsym(s) returns true if there is a pair in the table
with symbol s.
g_loc(s) returns the location of the pair containing s.
s_loc(s,x) changes the location in this pair to x.
Both g_loc and s_loc signal notexsym if the symbol
s is not in the table.