But, a client module N may contain a subtype of D providing a method that violates inv C . Thus, we need a module concept which provides semantically private classes , i.e., classes that can be hidden from clients of the module in the sense that their invariants are not part of the interface of the module. It is no longer necessary to reveal details of the implementation by exporting invariants which specify properties of the data representation. Semantical privacy can be achieved by enforcing certain syntactical restrictions of the implementation, by putting semantical constraints on invariants. To illustrate this approach, we introduce a predicate P on types.
T is concrete and P holds for the type of each attribute of T .
The invariant of a type for which P holds can not be affected by program extensions as subtyping is ruled out. This simple syntactical limitation is of course too restrictive as it forbids the use of subtyping. This combination enables semantical privacy and a restricted use of subtyping. In combination with behavioral subtyping, this constraint assures the preservation of the invariant. Assume, we have a class fraction with two attributes numerator and denominator of type int .