design by contract