Encapsulation — Monitor Concept | OneNoughtOne

0/105

Operating SystemsMonitors & Condition Variables

Monitor Concept

LevelIntermediate

Duration60 mins

TopicMonitors & Condition Variables

3 / 5

Encapsulation

Data Protection by Structure

Automatic mutual exclusion ensures that only one thread can execute inside a monitor at a time. But this guarantee alone is insufficient if external code can access the monitor's data directly, bypassing the synchronized procedures entirely. This is where encapsulation —the second pillar of the monitor abstraction—becomes essential. Encapsulation in monitors means that shared data is private to the monitor. External code cannot read or write this data directly; it can only interact through the monitor's public procedures. This seemingly simple property has profound consequences: it makes unsynchronized access not just inadvisable but syntactically impossible . This page explores encapsulation in depth. We will examine how encapsulation enforces synchronization, the relationship between information hiding and concurrency safety, the design of monitor interfaces, and how modern languages realize these principles.

Learning Objectives

By the end of this page, you will understand: (1) How encapsulation enforces synchronization by making unsynchronized access impossible, (2) The relationship between information hiding and thread safety, (3) How to design effective monitor interfaces, (4) The role of access modifiers in achieving encapsulation, (5) Common encapsulation violations and how to prevent them.

The Fundamental Principle

The fundamental principle of monitor encapsulation is simple: shared data is accessible only through synchronized procedures . This principle eliminates an entire category of concurrency bugs—those arising from direct, unsynchronized access to shared state. Why Direct Access is Dangerous: Consider a counter protected by a mutex. The mutex itself does not prevent direct access:

direct-access-danger.c
C (Unsafe)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
// Counter with manual synchronization - vulnerable to bypass
typedef struct {
    int value;              // Anyone can access this directly
    pthread_mutex_t lock;   // Programmer must remember to use this
} Counter;
 
void increment(Counter* c) {
    pthread_mutex_lock(&c->lock);
    c->value++;
    pthread_mutex_unlock(&c->lock);
}
 
// Later, somewhere else in the codebase...
void bug(Counter* c) {
    // Developer was in a hurry, forgot to lock
    c->value += 10;  // DIRECT ACCESS - race condition!
}
 
// Or even accidental:
void well_meaning_log(Counter* c) {
    printf("Current value: %d
", c->value);  // Read without lock!
    // May print torn value on 64-bit integers in 32-bit mode
    // Or may print stale value from cache
}
 
// The compiler cannot detect these bugs.
// The runtime does not prevent them.
// Only programmer discipline protects the invariant.

How Encapsulation Solves This: Monitor encapsulation makes the value field inaccessible from outside the monitor. There is no syntax for a bug—the code simply wouldn't compile:

encapsulation-safety.pseudo

// Monitor with encapsulated data - structurally safe
monitor Counter {
    private:
        int value = 0;    // Only accessible within this monitor
    
    public:
        procedure increment() {
            value++;      // Safe - inside monitor
        }
        
        procedure getValue() -> int {
            return value; // Safe - inside monitor
        }
}
 
// Attempted bypass:
// counter.value++;  ← SYNTAX ERROR! 'value' is not accessible
 
// Even with a pointer (in languages that have them):
// int* ptr = &counter.value;  ← ERROR! Cannot form address of private field
 
// The only way to interact:
counter.increment();        // Goes through synchronized procedure
int v = counter.getValue(); // Goes through synchronized procedure
 
||||||Java||||||
// Java equivalent with private field
public class Counter {
    private int value = 0;  // Private - cannot be accessed from outside
    
    public synchronized void increment() {
        value++;  // Safe - synchronized method
    }
    
    public synchronized int getValue() {
        return value;  // Safe - synchronized method
    }
}
 
// Attempted bypass:
Counter counter = new Counter();
// counter.value++;  ← COMPILE ERROR: value has private access
 
// No bypass possible. Every access goes through synchronized methods.

The Key Insight

Encapsulation transforms synchronization from a discipline problem into a structural invariant. With manual locking, correctness depends on every access remembering to lock. With monitors, correctness is enforced by the type system—unsynchronized access is not expressible.

Information Hiding and Thread Safety

The connection between information hiding and thread safety is deeper than it might initially appear. Information hiding is not merely about preventing unauthorized access—it creates well-defined synchronization boundaries . The Boundary Principle: A monitor defines a synchronization boundary. Inside the boundary (within monitor procedures), code executes with exclusive access to the monitor's data. Outside the boundary (external code), there is no access at all. This binary distinction eliminates ambiguity: Code inside the monitor: can access and modify shared data freely (under the lock) Code outside the monitor: cannot access shared data at all There is no intermediate state where code might or might not be correctly synchronized. This clarity dramatically simplifies reasoning about concurrent code.

Converting Mermaid diagram...

Representation Independence: Encapsulation provides representation independence : the internal representation of the monitor's data can change without affecting external code. This is valuable for concurrency because: Optimization : Internal data structures can be changed for performance without breaking clients Evolution : Synchronization strategies can evolve (e.g., adding read-write locking internally) Invariant maintenance : Complex invariants between internal fields can be maintained without external awareness Example: Balance Representation

representation-independence.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
// Version 1: Simple integer balance
public class Account {
    private int balanceCents;  // Internal representation
    
    public synchronized void deposit(int dollars, int cents) {
        balanceCents += dollars * 100 + cents;
    }
    
    public synchronized Money getBalance() {
        return new Money(balanceCents / 100, balanceCents % 100);
    }
}
 
// Version 2: Changed to use BigDecimal for precision
// External interface remains IDENTICAL
public class Account {
    private BigDecimal balance;  // Changed internal representation
    
    public synchronized void deposit(int dollars, int cents) {
        BigDecimal amount = BigDecimal.valueOf(dollars)
            .add(BigDecimal.valueOf(cents, 2));
        balance = balance.add(amount);
    }
    
    public synchronized Money getBalance() {
        int cents = balance.movePointRight(2).intValue();
        return new Money(cents / 100, cents % 100);
    }
}
 
// External code is unchanged:
account.deposit(100, 50);
Money m = account.getBalance();
 
// The encapsulation means external code never knew whether
// we used int or BigDecimal. No synchronization patterns
// needed to change in client code.

Encapsulation = Contract

The monitor's public procedures form a contract. The contract specifies what operations are available and their semantics, but not how they are implemented. This contract remains stable while implementation details (including synchronization strategies) can change.

Designing Monitor Interfaces

The design of a monitor's public interface is crucial for both usability and safety. A well-designed interface makes correct usage natural and incorrect usage difficult or impossible. Principle 1: Complete Operations Each monitor procedure should represent a complete, atomic operation on the abstraction. Avoid interfaces that require multiple calls to accomplish a single logical action: // BAD: Requires two calls, exposing intermediate state buffer.waitUntilNotEmpty(); // What if context switch here? item = buffer.remove(); // State may have changed! // GOOD: Single atomic operation item = buffer.get(); // Waits and removes atomically Principle 2: Return Values, Not References Always return values (copies) rather than references to internal data. A reference allows unsynchronized access:

reference-danger.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
// DANGEROUS: Leaking internal reference
public class MessageQueue {
    private List<Message> messages = new ArrayList<>();
    
    public synchronized void addMessage(Message m) {
        messages.add(m);
    }
    
    // DANGER: Returns reference to internal list!
    public synchronized List<Message> getMessages() {
        return messages;  // External code gets live reference
    }
}
 
// Attack:
MessageQueue q = new MessageQueue();
List<Message> ref = q.getMessages();
 
// Later, from any thread, without synchronization:
ref.clear();  // Modifies internal state without lock!
ref.add(maliciousMessage);  // Corrupts queue!
 
// SAFE: Return copy or unmodifiable view
public class MessageQueue {
    private List<Message> messages = new ArrayList<>();
    
    public synchronized void addMessage(Message m) {
        messages.add(m);
    }
    
    // SAFE: Returns a copy
    public synchronized List<Message> getMessages() {
        return new ArrayList<>(messages);  // Defensive copy
    }
    
    // Or: Return unmodifiable view (but may show stale data if mutated)
    public synchronized List<Message> getMessagesView() {
        return Collections.unmodifiableList(new ArrayList<>(messages));
    }
}

Principle 3: Transaction-Style Interfaces Group related reads and writes into single operations when they must be consistent: // BAD: Separate calls can see inconsistent state int balance = account.getBalance(); int limit = account.getLimit(); // Between these calls, another thread may have changed balance! boolean canWithdraw = balance > limit; // GOOD: Single consistent snapshot AccountState state = account.getState(); boolean canWithdraw = state.balance > state.limit; Principle 4: Immutable Return Types When returning complex data, use immutable objects. This prevents modification even if references are held beyond the monitor call:

immutable-returns.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
// Immutable snapshot class
public final class AccountSnapshot {
    private final int balance;
    private final int creditLimit;
    private final Instant lastTransaction;
    
    public AccountSnapshot(int balance, int creditLimit, Instant lastTransaction) {
        this.balance = balance;
        this.creditLimit = creditLimit;
        this.lastTransaction = lastTransaction;
    }
    
    // Only getters, no setters - immutable
    public int getBalance() { return balance; }
    public int getCreditLimit() { return creditLimit; }
    public Instant getLastTransaction() { return lastTransaction; }
}
 
// Monitor using immutable returns
public class Account {
    private int balance;
    private int creditLimit;
    private Instant lastTransaction;
    
    public synchronized void deposit(int amount) {
        balance += amount;
        lastTransaction = Instant.now();
    }
    
    // Returns immutable snapshot - safe to keep, share, cache
    public synchronized AccountSnapshot getSnapshot() {
        return new AccountSnapshot(balance, creditLimit, lastTransaction);
    }
}
 
// Safe usage:
AccountSnapshot snap = account.getSnapshot();
// snap is immutable - can be stored, passed around, analyzed
// without any synchronization concerns

Monitor Interface Design Principles

•Complete operations — Each procedure performs a complete, atomic action on the abstraction
•Defensive copies — Return copies of internal data, not references to live objects
•Immutable return types — Use immutable objects for complex return values
•Transaction-style reads — Group related data into single atomic reads
•No partial operations — Never require multiple calls for logical consistency
•Minimal surface area — Expose only necessary operations; fewer operations means fewer ways to misuse

Design for Invariants

Think of your monitor as maintaining invariants. Each procedure should preserve all invariants. The interface should make it impossible for external code to observe or create invalid states.

Access Control Mechanisms

Different programming languages provide different mechanisms for achieving the encapsulation that monitors require. Understanding these mechanisms is essential for implementing monitors correctly in each language. Java Access Modifiers: Java provides four access levels: private : Accessible only within the class (monitors should use this for data) Package-private (default): Accessible within the package protected : Accessible to subclasses public : Accessible everywhere For monitor data, private is the only correct choice. Other levels allow unsynchronized access from other classes. C++ Access Specifiers: Similar to Java: private : Class members only protected : Class and derived classes public : Everyone Plus the friend keyword, which grants access to specific external classes or functions—use with extreme caution in monitors. C Encapsulation (Opaque Types): C lacks access modifiers but achieves encapsulation through opaque handles :

c-encapsulation.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
// counter.h - Public header
// Users see only an opaque pointer
 
typedef struct Counter* CounterHandle;  // Opaque handle
 
// Public interface - these are the only operations available
CounterHandle counter_create(void);
void counter_destroy(CounterHandle c);
void counter_increment(CounterHandle c);
int counter_get_value(CounterHandle c);
 
// Users of this header cannot access internal fields!
// They don't even know what fields exist.
 
||||||C (Implementation)||||||
// counter.c - Private implementation
 
#include "counter.h"
#include <stdlib.h>
#include <pthread.h>
 
// Full struct definition - only visible in this file
struct Counter {
    int value;              // Internal data
    pthread_mutex_t lock;   // Internal synchronization
};
 
CounterHandle counter_create(void) {
    CounterHandle c = malloc(sizeof(struct Counter));
    c->value = 0;
    pthread_mutex_init(&c->lock, NULL);
    return c;
}
 
void counter_increment(CounterHandle c) {
    pthread_mutex_lock(&c->lock);
    c->value++;
    pthread_mutex_unlock(&c->lock);
}
 
int counter_get_value(CounterHandle c) {
    pthread_mutex_lock(&c->lock);
    int result = c->value;
    pthread_mutex_unlock(&c->lock);
    return result;
}
 
// External code cannot write:
// c->value++;  ← COMPILE ERROR: incomplete type
 
// The fields are truly hidden; the compiler doesn't
// even know what they are in other translation units.

Encapsulation Mechanisms Across Languages
Language	Mechanism	Data Visibility	Enforcement
Java	`private` keyword	Class scope only	Compile-time (reflection can bypass)
C#	`private` keyword	Class scope only	Compile-time + runtime (for partial trust)
C++	`private` specifier	Class scope only	Compile-time (pointer manipulation can bypass)
C	Opaque handles	Implementation file only	Linker (incomplete type)
Rust	Module privacy	Module scope only	Compile-time (no unsafe bypass)
Python	Naming convention (`_`)	Convention only	None (can always access)

Reflection and Encapsulation: In languages with reflection (Java, C#, Python), encapsulation can be bypassed programmatically: // Java reflection can access private fields Field f = counter.getClass().getDeclaredField("value"); f.setAccessible(true); f.setInt(counter, 999); // Bypassed encapsulation! This is a deliberate language design decision that trades some safety for flexibility. In practice: Frameworks use reflection for serialization, dependency injection, etc. Application code should avoid reflective access to other classes' privates Security managers can restrict reflection in sensitive contexts For monitor correctness, the important point is that ordinary code cannot bypass encapsulation. Reflection requires deliberate, explicit action that clearly signals "I am bypassing the normal rules."

Python Warning

Python's naming convention (_prefix for private) is purely advisory. Python relies on 'consenting adults' rather than enforcement. For concurrent code, this means extra discipline is required—nothing prevents unsynchronized access except programmer awareness.

Encapsulation Violations

Even with proper access modifiers, subtle violations of encapsulation can occur. These violations create holes through which unsynchronized access can happen. Recognizing and preventing these violations is essential for monitor correctness. Violation 1: Mutable Argument Capture If a monitor procedure accepts a mutable object as an argument and stores a reference to it, external code can modify the object without synchronization:

argument-capture.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
// DANGEROUS: Storing mutable argument reference
public class Config {
    private Map<String, String> settings;  // Private field
    
    public synchronized void setSettings(Map<String, String> newSettings) {
        this.settings = newSettings;  // Just storing the reference!
    }
    
    public synchronized String getSetting(String key) {
        return settings.get(key);
    }
}
 
// Attack:
Map<String, String> attackerMap = new HashMap<>();
config.setSettings(attackerMap);
 
// Later, from any thread, without synchronization:
attackerMap.put("admin", "true");  // Modifies config internals!
attackerMap.clear();                // Corrupts config!
 
// FIX: Defensive copy on input
public synchronized void setSettings(Map<String, String> newSettings) {
    this.settings = new HashMap<>(newSettings);  // Copy, don't reference
}

Violation 2: Mutable Field in Return Value We covered this earlier, but it bears repeating: returning a reference to internal mutable state breaks encapsulation. Violation 3: Publishing this During Construction If a monitor's constructor allows this to escape before construction completes, another thread may call methods on a partially constructed object:

this-escape.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
// DANGEROUS: Publishing 'this' during construction
public class BrokenMonitor {
    private int value;
    
    public BrokenMonitor(Registry registry) {
        // BUG: Publishing 'this' before construction completes
        registry.register(this);  // Another thread can now call methods!
        
        // Still initializing...
        this.value = computeInitialValue();  // May not have run yet!
    }
    
    public synchronized void doSomething() {
        System.out.println(value);  // May print 0 (default) if called early
    }
}
 
// FIX: Use factory method pattern
public class SafeMonitor {
    private int value;
    
    private SafeMonitor() {
        this.value = computeInitialValue();  // Fully initialize
    }
    
    // Factory method publishes only after complete initialization
    public static SafeMonitor create(Registry registry) {
        SafeMonitor m = new SafeMonitor();  // Fully constructed
        registry.register(m);                // Now safe to publish
        return m;
    }
}

Violation 4: Inner Class Access Inner classes in Java have access to enclosing class's private fields. If an inner class instance is returned, it can be used to access or modify the outer class's state without synchronization:

inner-class-danger.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
// DANGEROUS: Inner class leaks access to outer class fields
public class Container {
    private List<String> items = new ArrayList<>();
    
    // Inner class that provides iteration
    public class ItemIterator implements Iterator<String> {
        private int index = 0;
        
        @Override
        public boolean hasNext() {
            return index < items.size();  // Access to outer's 'items'
        }
        
        @Override  
        public String next() {
            return items.get(index++);  // Direct access to 'items'!
        }
    }
    
    public synchronized void addItem(String item) {
        items.add(item);
    }
    
    // DANGER: Returns inner class that can access 'items' directly
    public synchronized ItemIterator getIterator() {
        return new ItemIterator();  // Leaks access to internal list
    }
}
 
// Attack:
Container c = new Container();
Iterator<String> iter = c.getIterator();
 
// Method calls on 'iter' access 'items' without synchronization!
while (iter.hasNext()) {  // Not synchronized
    String s = iter.next();  // Not synchronized
}
 
// FIX: Use static inner class with a snapshot
public static class SafeIterator implements Iterator<String> {
    private final List<String> snapshot;
    private int index = 0;
    
    public SafeIterator(List<String> items) {
        this.snapshot = new ArrayList<>(items);  // Copy at creation
    }
    // Now iteration is over a private copy
}

Common Encapsulation Violations

•Storing mutable arguments — Copy incoming mutable objects; don't store references
•Returning mutable references — Return copies or immutable views of internal data
•Publishing this in constructor — Use factory methods if registration is needed
•Inner class access — Inner classes can bypass encapsulation of outer class
•Reflection abuse — setAccessible(true) can bypass any access control
•Native code access — JNI or FFI can directly manipulate memory

Defensive Programming

When in doubt, copy. Defensive copies add overhead but guarantee encapsulation. Profile before optimizing away defensive copies—the bugs they prevent are often subtle and expensive to diagnose.

Encapsulation in Practice

Let's apply encapsulation principles to design a realistic monitor. We'll implement a thread-safe cache with proper encapsulation, demonstrating how the principles work together. Requirements: Store key-value pairs with a maximum capacity Evict oldest entries when capacity is exceeded Thread-safe for concurrent access No external access to internal structures

encapsulated-cache.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
import java.util.*;
import java.time.Instant;
 
/**
 * Thread-safe LRU cache with proper encapsulation.
 * All public methods are synchronized.
 * No internal references are exposed.
 */
public final class ThreadSafeCache<K, V> {  // final prevents subclassing
    
    // ===== PRIVATE STATE =====
    
    // Internal entry class - not visible externally
    private static final class CacheEntry<V> {
        final V value;          // Immutable reference
        final Instant timestamp;
        
        CacheEntry(V value) {
            this.value = value;
            this.timestamp = Instant.now();
        }
    }
    
    private final int maxCapacity;
    private final LinkedHashMap<K, CacheEntry<V>> storage;  // LRU via access order
    
    // ===== CONSTRUCTOR =====
    
    public ThreadSafeCache(int maxCapacity) {
        if (maxCapacity <= 0) {
            throw new IllegalArgumentException("Capacity must be positive");
        }
        this.maxCapacity = maxCapacity;
        
        // LinkedHashMap with access order = true gives LRU behavior
        // Override removeEldestEntry for capacity management
        this.storage = new LinkedHashMap<>(16, 0.75f, true) {
            @Override
            protected boolean removeEldestEntry(Map.Entry<K, CacheEntry<V>> eldest) {
                return size() > ThreadSafeCache.this.maxCapacity;
            }
        };
    }
    
    // ===== PUBLIC INTERFACE =====
    
    /**
     * Stores a value in the cache.
     * @param key The key (must not be null)
     * @param value The value to cache
     */
    public synchronized void put(K key, V value) {
        Objects.requireNonNull(key, "Key cannot be null");
        storage.put(key, new CacheEntry<>(value));
    }
    
    /**
     * Retrieves a value from the cache.
     * @param key The key to look up
     * @return Optional containing the value, or empty if not found
     */
    public synchronized Optional<V> get(K key) {
        CacheEntry<V> entry = storage.get(key);
        if (entry == null) {
            return Optional.empty();
        }
        // Return the value directly - if V is mutable, caller gets reference
        // For truly safe caches, V should be immutable or copied
        return Optional.of(entry.value);
    }
    
    /**
     * Removes a key from the cache.
     * @param key The key to remove
     * @return true if the key was present and removed
     */
    public synchronized boolean remove(K key) {
        return storage.remove(key) != null;
    }
    
    /**
     * Returns a snapshot of cache statistics.
     * Returns an immutable object - safe to keep and analyze later.
     */
    public synchronized CacheStats getStats() {
        return new CacheStats(storage.size(), maxCapacity);
    }
    
    /**
     * Returns a copy of all keys currently in the cache.
     * The returned set is a snapshot - modifications don't affect the cache.
     */
    public synchronized Set<K> getKeys() {
        return new HashSet<>(storage.keySet());  // Defensive copy
    }
    
    // Note: We do NOT provide:
    // - getStorage() returning the LinkedHashMap
    // - Any method returning CacheEntry objects
    // - Any iterable over the internal structure
    // - Direct access to timestamps
    
    // ===== IMMUTABLE STATS CLASS =====
    
    /**
     * Immutable cache statistics snapshot.
     */
    public static final class CacheStats {
        private final int currentSize;
        private final int maxCapacity;
        private final Instant snapshotTime;
        
        private CacheStats(int currentSize, int maxCapacity) {
            this.currentSize = currentSize;
            this.maxCapacity = maxCapacity;
            this.snapshotTime = Instant.now();
        }
        
        public int getCurrentSize() { return currentSize; }
        public int getMaxCapacity() { return maxCapacity; }
        public double getUtilization() { 
            return (double) currentSize / maxCapacity; 
        }
        public Instant getSnapshotTime() { return snapshotTime; }
    }
}

Analysis of Encapsulation: Private storage : The LinkedHashMap is private. No method returns it or any reference into it. Private entry class : CacheEntry is a private static nested class. External code cannot create or access entries. Defensive copies : getKeys() returns a copy of the key set, not a view into the live set. Immutable returns : getStats() returns an immutable CacheStats object. It's safe to store, share, and analyze without synchronization. final class : The class is final, preventing subclasses from violating encapsulation by overriding methods. Input validation : Null keys are rejected immediately, maintaining internal invariants. No dangerous methods : We deliberately did not provide methods that would leak internal structure.

Complete Encapsulation

This cache implementation demonstrates complete encapsulation. Every interaction goes through synchronized methods. No internal reference escapes. Stats are immutable snapshots. The only way to affect the cache state is through the documented public interface.

Relationship to Object-Oriented Design

Monitor encapsulation is closely related to—but distinct from—object-oriented encapsulation. Understanding the relationship clarifies how OO design principles apply to concurrent programming. OO Encapsulation: Object-oriented encapsulation (information hiding) has goals including: Reducing coupling between components Enabling implementation changes without affecting clients Providing clear interfaces for interaction Maintaining object invariants Monitor Encapsulation: Monitor encapsulation shares these goals but adds: Guaranteeing all access is synchronized Defining a synchronization boundary Preventing race conditions by structure The key difference is that OO encapsulation is primarily about modularity and maintainability, while monitor encapsulation is about correctness in concurrent execution . A well-encapsulated OO class may still have race conditions if its methods aren't synchronized.

OO Encapsulation vs Monitor Encapsulation
Aspect	OO Encapsulation	Monitor Encapsulation
Primary goal	Modularity, maintainability	Thread safety, race condition prevention
Access control	Limits which code can access	Ensures all access is synchronized
Private data	Hidden for information hiding	Hidden AND all access serialized
Methods	Interface for interaction	Synchronized interface for interaction
Without it	High coupling, fragile code	Race conditions, data corruption
Language support	Access modifiers	synchronized + access modifiers

Composing OO and Monitor Principles: The best concurrent objects combine both: Information hiding (OO): Hide implementation details, expose clean interfaces Synchronization (Monitor): Ensure all interface methods are properly synchronized Immutability where possible: Immutable objects need no synchronization Thread confinement where applicable: Objects used by single thread need no synchronization When designing concurrent systems, apply OO design first (identify responsibilities, define interfaces, encapsulate state), then add synchronization (make interfaces thread-safe, define synchronization boundaries).

Good OO ≠ Thread Safety

A class can be perfectly designed from an OO perspective—private fields, clean interface, single responsibility—yet have severe race conditions because none of its methods are synchronized. Thread safety requires explicit attention beyond good OO design.

Operating SystemsMonitors & Condition Variables

Monitor Concept

LevelIntermediate

Duration60 mins

TopicMonitors & Condition Variables

3 / 5

Encapsulation

Data Protection by Structure

Automatic mutual exclusion ensures that only one thread can execute inside a monitor at a time. But this guarantee alone is insufficient if external code can access the monitor's data directly, bypassing the synchronized procedures entirely. This is where encapsulation —the second pillar of the monitor abstraction—becomes essential. Encapsulation in monitors means that shared data is private to the monitor. External code cannot read or write this data directly; it can only interact through the monitor's public procedures. This seemingly simple property has profound consequences: it makes unsynchronized access not just inadvisable but syntactically impossible . This page explores encapsulation in depth. We will examine how encapsulation enforces synchronization, the relationship between information hiding and concurrency safety, the design of monitor interfaces, and how modern languages realize these principles.

Learning Objectives

By the end of this page, you will understand: (1) How encapsulation enforces synchronization by making unsynchronized access impossible, (2) The relationship between information hiding and thread safety, (3) How to design effective monitor interfaces, (4) The role of access modifiers in achieving encapsulation, (5) Common encapsulation violations and how to prevent them.

The Fundamental Principle

The fundamental principle of monitor encapsulation is simple: shared data is accessible only through synchronized procedures . This principle eliminates an entire category of concurrency bugs—those arising from direct, unsynchronized access to shared state. Why Direct Access is Dangerous: Consider a counter protected by a mutex. The mutex itself does not prevent direct access:

direct-access-danger.c
C (Unsafe)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
// Counter with manual synchronization - vulnerable to bypass
typedef struct {
    int value;              // Anyone can access this directly
    pthread_mutex_t lock;   // Programmer must remember to use this
} Counter;
 
void increment(Counter* c) {
    pthread_mutex_lock(&c->lock);
    c->value++;
    pthread_mutex_unlock(&c->lock);
}
 
// Later, somewhere else in the codebase...
void bug(Counter* c) {
    // Developer was in a hurry, forgot to lock
    c->value += 10;  // DIRECT ACCESS - race condition!
}
 
// Or even accidental:
void well_meaning_log(Counter* c) {
    printf("Current value: %d
", c->value);  // Read without lock!
    // May print torn value on 64-bit integers in 32-bit mode
    // Or may print stale value from cache
}
 
// The compiler cannot detect these bugs.
// The runtime does not prevent them.
// Only programmer discipline protects the invariant.

How Encapsulation Solves This: Monitor encapsulation makes the value field inaccessible from outside the monitor. There is no syntax for a bug—the code simply wouldn't compile:

encapsulation-safety.pseudo

// Monitor with encapsulated data - structurally safe
monitor Counter {
    private:
        int value = 0;    // Only accessible within this monitor
    
    public:
        procedure increment() {
            value++;      // Safe - inside monitor
        }
        
        procedure getValue() -> int {
            return value; // Safe - inside monitor
        }
}
 
// Attempted bypass:
// counter.value++;  ← SYNTAX ERROR! 'value' is not accessible
 
// Even with a pointer (in languages that have them):
// int* ptr = &counter.value;  ← ERROR! Cannot form address of private field
 
// The only way to interact:
counter.increment();        // Goes through synchronized procedure
int v = counter.getValue(); // Goes through synchronized procedure
 
||||||Java||||||
// Java equivalent with private field
public class Counter {
    private int value = 0;  // Private - cannot be accessed from outside
    
    public synchronized void increment() {
        value++;  // Safe - synchronized method
    }
    
    public synchronized int getValue() {
        return value;  // Safe - synchronized method
    }
}
 
// Attempted bypass:
Counter counter = new Counter();
// counter.value++;  ← COMPILE ERROR: value has private access
 
// No bypass possible. Every access goes through synchronized methods.

The Key Insight

Encapsulation transforms synchronization from a discipline problem into a structural invariant. With manual locking, correctness depends on every access remembering to lock. With monitors, correctness is enforced by the type system—unsynchronized access is not expressible.

Information Hiding and Thread Safety

The connection between information hiding and thread safety is deeper than it might initially appear. Information hiding is not merely about preventing unauthorized access—it creates well-defined synchronization boundaries . The Boundary Principle: A monitor defines a synchronization boundary. Inside the boundary (within monitor procedures), code executes with exclusive access to the monitor's data. Outside the boundary (external code), there is no access at all. This binary distinction eliminates ambiguity: Code inside the monitor: can access and modify shared data freely (under the lock) Code outside the monitor: cannot access shared data at all There is no intermediate state where code might or might not be correctly synchronized. This clarity dramatically simplifies reasoning about concurrent code.

Converting Mermaid diagram...

Representation Independence: Encapsulation provides representation independence : the internal representation of the monitor's data can change without affecting external code. This is valuable for concurrency because: Optimization : Internal data structures can be changed for performance without breaking clients Evolution : Synchronization strategies can evolve (e.g., adding read-write locking internally) Invariant maintenance : Complex invariants between internal fields can be maintained without external awareness Example: Balance Representation

representation-independence.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
// Version 1: Simple integer balance
public class Account {
    private int balanceCents;  // Internal representation
    
    public synchronized void deposit(int dollars, int cents) {
        balanceCents += dollars * 100 + cents;
    }
    
    public synchronized Money getBalance() {
        return new Money(balanceCents / 100, balanceCents % 100);
    }
}
 
// Version 2: Changed to use BigDecimal for precision
// External interface remains IDENTICAL
public class Account {
    private BigDecimal balance;  // Changed internal representation
    
    public synchronized void deposit(int dollars, int cents) {
        BigDecimal amount = BigDecimal.valueOf(dollars)
            .add(BigDecimal.valueOf(cents, 2));
        balance = balance.add(amount);
    }
    
    public synchronized Money getBalance() {
        int cents = balance.movePointRight(2).intValue();
        return new Money(cents / 100, cents % 100);
    }
}
 
// External code is unchanged:
account.deposit(100, 50);
Money m = account.getBalance();
 
// The encapsulation means external code never knew whether
// we used int or BigDecimal. No synchronization patterns
// needed to change in client code.

Encapsulation = Contract

The monitor's public procedures form a contract. The contract specifies what operations are available and their semantics, but not how they are implemented. This contract remains stable while implementation details (including synchronization strategies) can change.

Designing Monitor Interfaces

The design of a monitor's public interface is crucial for both usability and safety. A well-designed interface makes correct usage natural and incorrect usage difficult or impossible. Principle 1: Complete Operations Each monitor procedure should represent a complete, atomic operation on the abstraction. Avoid interfaces that require multiple calls to accomplish a single logical action: // BAD: Requires two calls, exposing intermediate state buffer.waitUntilNotEmpty(); // What if context switch here? item = buffer.remove(); // State may have changed! // GOOD: Single atomic operation item = buffer.get(); // Waits and removes atomically Principle 2: Return Values, Not References Always return values (copies) rather than references to internal data. A reference allows unsynchronized access:

reference-danger.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
// DANGEROUS: Leaking internal reference
public class MessageQueue {
    private List<Message> messages = new ArrayList<>();
    
    public synchronized void addMessage(Message m) {
        messages.add(m);
    }
    
    // DANGER: Returns reference to internal list!
    public synchronized List<Message> getMessages() {
        return messages;  // External code gets live reference
    }
}
 
// Attack:
MessageQueue q = new MessageQueue();
List<Message> ref = q.getMessages();
 
// Later, from any thread, without synchronization:
ref.clear();  // Modifies internal state without lock!
ref.add(maliciousMessage);  // Corrupts queue!
 
// SAFE: Return copy or unmodifiable view
public class MessageQueue {
    private List<Message> messages = new ArrayList<>();
    
    public synchronized void addMessage(Message m) {
        messages.add(m);
    }
    
    // SAFE: Returns a copy
    public synchronized List<Message> getMessages() {
        return new ArrayList<>(messages);  // Defensive copy
    }
    
    // Or: Return unmodifiable view (but may show stale data if mutated)
    public synchronized List<Message> getMessagesView() {
        return Collections.unmodifiableList(new ArrayList<>(messages));
    }
}

Principle 3: Transaction-Style Interfaces Group related reads and writes into single operations when they must be consistent: // BAD: Separate calls can see inconsistent state int balance = account.getBalance(); int limit = account.getLimit(); // Between these calls, another thread may have changed balance! boolean canWithdraw = balance > limit; // GOOD: Single consistent snapshot AccountState state = account.getState(); boolean canWithdraw = state.balance > state.limit; Principle 4: Immutable Return Types When returning complex data, use immutable objects. This prevents modification even if references are held beyond the monitor call:

immutable-returns.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
// Immutable snapshot class
public final class AccountSnapshot {
    private final int balance;
    private final int creditLimit;
    private final Instant lastTransaction;
    
    public AccountSnapshot(int balance, int creditLimit, Instant lastTransaction) {
        this.balance = balance;
        this.creditLimit = creditLimit;
        this.lastTransaction = lastTransaction;
    }
    
    // Only getters, no setters - immutable
    public int getBalance() { return balance; }
    public int getCreditLimit() { return creditLimit; }
    public Instant getLastTransaction() { return lastTransaction; }
}
 
// Monitor using immutable returns
public class Account {
    private int balance;
    private int creditLimit;
    private Instant lastTransaction;
    
    public synchronized void deposit(int amount) {
        balance += amount;
        lastTransaction = Instant.now();
    }
    
    // Returns immutable snapshot - safe to keep, share, cache
    public synchronized AccountSnapshot getSnapshot() {
        return new AccountSnapshot(balance, creditLimit, lastTransaction);
    }
}
 
// Safe usage:
AccountSnapshot snap = account.getSnapshot();
// snap is immutable - can be stored, passed around, analyzed
// without any synchronization concerns

Monitor Interface Design Principles

•Complete operations — Each procedure performs a complete, atomic action on the abstraction
•Defensive copies — Return copies of internal data, not references to live objects
•Immutable return types — Use immutable objects for complex return values
•Transaction-style reads — Group related data into single atomic reads
•No partial operations — Never require multiple calls for logical consistency
•Minimal surface area — Expose only necessary operations; fewer operations means fewer ways to misuse

Design for Invariants

Think of your monitor as maintaining invariants. Each procedure should preserve all invariants. The interface should make it impossible for external code to observe or create invalid states.

Access Control Mechanisms

Different programming languages provide different mechanisms for achieving the encapsulation that monitors require. Understanding these mechanisms is essential for implementing monitors correctly in each language. Java Access Modifiers: Java provides four access levels: private : Accessible only within the class (monitors should use this for data) Package-private (default): Accessible within the package protected : Accessible to subclasses public : Accessible everywhere For monitor data, private is the only correct choice. Other levels allow unsynchronized access from other classes. C++ Access Specifiers: Similar to Java: private : Class members only protected : Class and derived classes public : Everyone Plus the friend keyword, which grants access to specific external classes or functions—use with extreme caution in monitors. C Encapsulation (Opaque Types): C lacks access modifiers but achieves encapsulation through opaque handles :

c-encapsulation.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
// counter.h - Public header
// Users see only an opaque pointer
 
typedef struct Counter* CounterHandle;  // Opaque handle
 
// Public interface - these are the only operations available
CounterHandle counter_create(void);
void counter_destroy(CounterHandle c);
void counter_increment(CounterHandle c);
int counter_get_value(CounterHandle c);
 
// Users of this header cannot access internal fields!
// They don't even know what fields exist.
 
||||||C (Implementation)||||||
// counter.c - Private implementation
 
#include "counter.h"
#include <stdlib.h>
#include <pthread.h>
 
// Full struct definition - only visible in this file
struct Counter {
    int value;              // Internal data
    pthread_mutex_t lock;   // Internal synchronization
};
 
CounterHandle counter_create(void) {
    CounterHandle c = malloc(sizeof(struct Counter));
    c->value = 0;
    pthread_mutex_init(&c->lock, NULL);
    return c;
}
 
void counter_increment(CounterHandle c) {
    pthread_mutex_lock(&c->lock);
    c->value++;
    pthread_mutex_unlock(&c->lock);
}
 
int counter_get_value(CounterHandle c) {
    pthread_mutex_lock(&c->lock);
    int result = c->value;
    pthread_mutex_unlock(&c->lock);
    return result;
}
 
// External code cannot write:
// c->value++;  ← COMPILE ERROR: incomplete type
 
// The fields are truly hidden; the compiler doesn't
// even know what they are in other translation units.

Encapsulation Mechanisms Across Languages
Language	Mechanism	Data Visibility	Enforcement
Java	`private` keyword	Class scope only	Compile-time (reflection can bypass)
C#	`private` keyword	Class scope only	Compile-time + runtime (for partial trust)
C++	`private` specifier	Class scope only	Compile-time (pointer manipulation can bypass)
C	Opaque handles	Implementation file only	Linker (incomplete type)
Rust	Module privacy	Module scope only	Compile-time (no unsafe bypass)
Python	Naming convention (`_`)	Convention only	None (can always access)

Reflection and Encapsulation: In languages with reflection (Java, C#, Python), encapsulation can be bypassed programmatically: // Java reflection can access private fields Field f = counter.getClass().getDeclaredField("value"); f.setAccessible(true); f.setInt(counter, 999); // Bypassed encapsulation! This is a deliberate language design decision that trades some safety for flexibility. In practice: Frameworks use reflection for serialization, dependency injection, etc. Application code should avoid reflective access to other classes' privates Security managers can restrict reflection in sensitive contexts For monitor correctness, the important point is that ordinary code cannot bypass encapsulation. Reflection requires deliberate, explicit action that clearly signals "I am bypassing the normal rules."

Python Warning

Python's naming convention (_prefix for private) is purely advisory. Python relies on 'consenting adults' rather than enforcement. For concurrent code, this means extra discipline is required—nothing prevents unsynchronized access except programmer awareness.

Encapsulation Violations

Even with proper access modifiers, subtle violations of encapsulation can occur. These violations create holes through which unsynchronized access can happen. Recognizing and preventing these violations is essential for monitor correctness. Violation 1: Mutable Argument Capture If a monitor procedure accepts a mutable object as an argument and stores a reference to it, external code can modify the object without synchronization:

argument-capture.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
// DANGEROUS: Storing mutable argument reference
public class Config {
    private Map<String, String> settings;  // Private field
    
    public synchronized void setSettings(Map<String, String> newSettings) {
        this.settings = newSettings;  // Just storing the reference!
    }
    
    public synchronized String getSetting(String key) {
        return settings.get(key);
    }
}
 
// Attack:
Map<String, String> attackerMap = new HashMap<>();
config.setSettings(attackerMap);
 
// Later, from any thread, without synchronization:
attackerMap.put("admin", "true");  // Modifies config internals!
attackerMap.clear();                // Corrupts config!
 
// FIX: Defensive copy on input
public synchronized void setSettings(Map<String, String> newSettings) {
    this.settings = new HashMap<>(newSettings);  // Copy, don't reference
}

Violation 2: Mutable Field in Return Value We covered this earlier, but it bears repeating: returning a reference to internal mutable state breaks encapsulation. Violation 3: Publishing this During Construction If a monitor's constructor allows this to escape before construction completes, another thread may call methods on a partially constructed object:

this-escape.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
// DANGEROUS: Publishing 'this' during construction
public class BrokenMonitor {
    private int value;
    
    public BrokenMonitor(Registry registry) {
        // BUG: Publishing 'this' before construction completes
        registry.register(this);  // Another thread can now call methods!
        
        // Still initializing...
        this.value = computeInitialValue();  // May not have run yet!
    }
    
    public synchronized void doSomething() {
        System.out.println(value);  // May print 0 (default) if called early
    }
}
 
// FIX: Use factory method pattern
public class SafeMonitor {
    private int value;
    
    private SafeMonitor() {
        this.value = computeInitialValue();  // Fully initialize
    }
    
    // Factory method publishes only after complete initialization
    public static SafeMonitor create(Registry registry) {
        SafeMonitor m = new SafeMonitor();  // Fully constructed
        registry.register(m);                // Now safe to publish
        return m;
    }
}

Violation 4: Inner Class Access Inner classes in Java have access to enclosing class's private fields. If an inner class instance is returned, it can be used to access or modify the outer class's state without synchronization:

inner-class-danger.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
// DANGEROUS: Inner class leaks access to outer class fields
public class Container {
    private List<String> items = new ArrayList<>();
    
    // Inner class that provides iteration
    public class ItemIterator implements Iterator<String> {
        private int index = 0;
        
        @Override
        public boolean hasNext() {
            return index < items.size();  // Access to outer's 'items'
        }
        
        @Override  
        public String next() {
            return items.get(index++);  // Direct access to 'items'!
        }
    }
    
    public synchronized void addItem(String item) {
        items.add(item);
    }
    
    // DANGER: Returns inner class that can access 'items' directly
    public synchronized ItemIterator getIterator() {
        return new ItemIterator();  // Leaks access to internal list
    }
}
 
// Attack:
Container c = new Container();
Iterator<String> iter = c.getIterator();
 
// Method calls on 'iter' access 'items' without synchronization!
while (iter.hasNext()) {  // Not synchronized
    String s = iter.next();  // Not synchronized
}
 
// FIX: Use static inner class with a snapshot
public static class SafeIterator implements Iterator<String> {
    private final List<String> snapshot;
    private int index = 0;
    
    public SafeIterator(List<String> items) {
        this.snapshot = new ArrayList<>(items);  // Copy at creation
    }
    // Now iteration is over a private copy
}

Common Encapsulation Violations

•Storing mutable arguments — Copy incoming mutable objects; don't store references
•Returning mutable references — Return copies or immutable views of internal data
•Publishing this in constructor — Use factory methods if registration is needed
•Inner class access — Inner classes can bypass encapsulation of outer class
•Reflection abuse — setAccessible(true) can bypass any access control
•Native code access — JNI or FFI can directly manipulate memory

Defensive Programming

When in doubt, copy. Defensive copies add overhead but guarantee encapsulation. Profile before optimizing away defensive copies—the bugs they prevent are often subtle and expensive to diagnose.

Encapsulation in Practice

Let's apply encapsulation principles to design a realistic monitor. We'll implement a thread-safe cache with proper encapsulation, demonstrating how the principles work together. Requirements: Store key-value pairs with a maximum capacity Evict oldest entries when capacity is exceeded Thread-safe for concurrent access No external access to internal structures

encapsulated-cache.java
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
import java.util.*;
import java.time.Instant;
 
/**
 * Thread-safe LRU cache with proper encapsulation.
 * All public methods are synchronized.
 * No internal references are exposed.
 */
public final class ThreadSafeCache<K, V> {  // final prevents subclassing
    
    // ===== PRIVATE STATE =====
    
    // Internal entry class - not visible externally
    private static final class CacheEntry<V> {
        final V value;          // Immutable reference
        final Instant timestamp;
        
        CacheEntry(V value) {
            this.value = value;
            this.timestamp = Instant.now();
        }
    }
    
    private final int maxCapacity;
    private final LinkedHashMap<K, CacheEntry<V>> storage;  // LRU via access order
    
    // ===== CONSTRUCTOR =====
    
    public ThreadSafeCache(int maxCapacity) {
        if (maxCapacity <= 0) {
            throw new IllegalArgumentException("Capacity must be positive");
        }
        this.maxCapacity = maxCapacity;
        
        // LinkedHashMap with access order = true gives LRU behavior
        // Override removeEldestEntry for capacity management
        this.storage = new LinkedHashMap<>(16, 0.75f, true) {
            @Override
            protected boolean removeEldestEntry(Map.Entry<K, CacheEntry<V>> eldest) {
                return size() > ThreadSafeCache.this.maxCapacity;
            }
        };
    }
    
    // ===== PUBLIC INTERFACE =====
    
    /**
     * Stores a value in the cache.
     * @param key The key (must not be null)
     * @param value The value to cache
     */
    public synchronized void put(K key, V value) {
        Objects.requireNonNull(key, "Key cannot be null");
        storage.put(key, new CacheEntry<>(value));
    }
    
    /**
     * Retrieves a value from the cache.
     * @param key The key to look up
     * @return Optional containing the value, or empty if not found
     */
    public synchronized Optional<V> get(K key) {
        CacheEntry<V> entry = storage.get(key);
        if (entry == null) {
            return Optional.empty();
        }
        // Return the value directly - if V is mutable, caller gets reference
        // For truly safe caches, V should be immutable or copied
        return Optional.of(entry.value);
    }
    
    /**
     * Removes a key from the cache.
     * @param key The key to remove
     * @return true if the key was present and removed
     */
    public synchronized boolean remove(K key) {
        return storage.remove(key) != null;
    }
    
    /**
     * Returns a snapshot of cache statistics.
     * Returns an immutable object - safe to keep and analyze later.
     */
    public synchronized CacheStats getStats() {
        return new CacheStats(storage.size(), maxCapacity);
    }
    
    /**
     * Returns a copy of all keys currently in the cache.
     * The returned set is a snapshot - modifications don't affect the cache.
     */
    public synchronized Set<K> getKeys() {
        return new HashSet<>(storage.keySet());  // Defensive copy
    }
    
    // Note: We do NOT provide:
    // - getStorage() returning the LinkedHashMap
    // - Any method returning CacheEntry objects
    // - Any iterable over the internal structure
    // - Direct access to timestamps
    
    // ===== IMMUTABLE STATS CLASS =====
    
    /**
     * Immutable cache statistics snapshot.
     */
    public static final class CacheStats {
        private final int currentSize;
        private final int maxCapacity;
        private final Instant snapshotTime;
        
        private CacheStats(int currentSize, int maxCapacity) {
            this.currentSize = currentSize;
            this.maxCapacity = maxCapacity;
            this.snapshotTime = Instant.now();
        }
        
        public int getCurrentSize() { return currentSize; }
        public int getMaxCapacity() { return maxCapacity; }
        public double getUtilization() { 
            return (double) currentSize / maxCapacity; 
        }
        public Instant getSnapshotTime() { return snapshotTime; }
    }
}

Analysis of Encapsulation: Private storage : The LinkedHashMap is private. No method returns it or any reference into it. Private entry class : CacheEntry is a private static nested class. External code cannot create or access entries. Defensive copies : getKeys() returns a copy of the key set, not a view into the live set. Immutable returns : getStats() returns an immutable CacheStats object. It's safe to store, share, and analyze without synchronization. final class : The class is final, preventing subclasses from violating encapsulation by overriding methods. Input validation : Null keys are rejected immediately, maintaining internal invariants. No dangerous methods : We deliberately did not provide methods that would leak internal structure.

Complete Encapsulation

This cache implementation demonstrates complete encapsulation. Every interaction goes through synchronized methods. No internal reference escapes. Stats are immutable snapshots. The only way to affect the cache state is through the documented public interface.

Relationship to Object-Oriented Design

Monitor encapsulation is closely related to—but distinct from—object-oriented encapsulation. Understanding the relationship clarifies how OO design principles apply to concurrent programming. OO Encapsulation: Object-oriented encapsulation (information hiding) has goals including: Reducing coupling between components Enabling implementation changes without affecting clients Providing clear interfaces for interaction Maintaining object invariants Monitor Encapsulation: Monitor encapsulation shares these goals but adds: Guaranteeing all access is synchronized Defining a synchronization boundary Preventing race conditions by structure The key difference is that OO encapsulation is primarily about modularity and maintainability, while monitor encapsulation is about correctness in concurrent execution . A well-encapsulated OO class may still have race conditions if its methods aren't synchronized.

OO Encapsulation vs Monitor Encapsulation
Aspect	OO Encapsulation	Monitor Encapsulation
Primary goal	Modularity, maintainability	Thread safety, race condition prevention
Access control	Limits which code can access	Ensures all access is synchronized
Private data	Hidden for information hiding	Hidden AND all access serialized
Methods	Interface for interaction	Synchronized interface for interaction
Without it	High coupling, fragile code	Race conditions, data corruption
Language support	Access modifiers	synchronized + access modifiers

Composing OO and Monitor Principles: The best concurrent objects combine both: Information hiding (OO): Hide implementation details, expose clean interfaces Synchronization (Monitor): Ensure all interface methods are properly synchronized Immutability where possible: Immutable objects need no synchronization Thread confinement where applicable: Objects used by single thread need no synchronization When designing concurrent systems, apply OO design first (identify responsibilities, define interfaces, encapsulate state), then add synchronization (make interfaces thread-safe, define synchronization boundaries).

Good OO ≠ Thread Safety

A class can be perfectly designed from an OO perspective—private fields, clean interface, single responsibility—yet have severe race conditions because none of its methods are synchronized. Thread safety requires explicit attention beyond good OO design.

Encapsulation

Data Protection by Structure

The Fundamental Principle

Information Hiding and Thread Safety

Designing Monitor Interfaces

Access Control Mechanisms

Encapsulation Violations

Encapsulation in Practice

Relationship to Object-Oriented Design

There’s more to understand.

Encapsulation

Data Protection by Structure

The Fundamental Principle

Information Hiding and Thread Safety

Designing Monitor Interfaces

Access Control Mechanisms

Encapsulation Violations

Encapsulation in Practice

Relationship to Object-Oriented Design

There’s more to understand.