Article

An automatic verifier for Java-like programs based on dynamic frames

Authors:

Frank Piessens,

Wolfram SchulteAuthors Info & Claims

FASE'08/ETAPS'08: Proceedings of the Theory and practice of software, 11th international conference on Fundamental approaches to software engineering

Pages 261 - 275

Published: 29 March 2008 Publication History

Abstract

Data abstraction is crucial in the construction of modular programs, since it ensures that internal changes in one module do not propagate to other modules. In object-oriented programs, classes typically enforce data abstraction by providing access to their internal state only through methods. By using method calls in method contracts, data abstraction can be extended to specifications. In this paper, methods used for this purpose must be side-effect free, and are called pure methods.

We present an approach to the automatic verification of object-oriented programs that use pure methods for data abstraction. The cornerstone of our approach is the solution to the framing problem, i.e. client code must be able to determine whether state changes affect the return values of pure methods. More specifically, we extend each method contract with a method footprint, an upper bound on the memory locations read or written by the corresponding method. Footprints are specified using dynamic frames, special pure methods that return sets of memory locations. Thanks to this abstraction, implementations can evolve independently from specifications, loosely coupled only by pure functions.

We implemented this approach in a custom build of the Spec# program verifier, and used it to automatically verify several challenging programs, including the iterator and observer patterns. The verifier itself and the examples shown in this paper can be downloaded from the authors' homepage [1].

References

[1]

http://www.cs.kuleuven.be/~jans/DFJ

[2]

Leavens, G.T., Leino, K.R.M., Müller, P.: Specification and verification challenges for sequential object-oriented programs. In: Formal Aspects of Computing.

[3]

Kassios, Y.: A Theory of Object Oriented Refinement. PhD thesis, University of Toronto (2006).

Digital Library

[4]

Kassios, Y.T.: Dynamic frames: Support for framing, dependencies and sharing without restrictions. In: Formal Methods (2006).

Digital Library

[5]

Leino, K.R.M., Schulte, W.: A verifying compiler for a multi-threaded object-oriented language. In: Marktoberdorf Summer School Lecture Notes (2006).

[6]

Barnett, M., DeLine, R., Fahndrich, M., Leino, K.R.M., Schulte, W.: Verification of object-oriented programs with invariants. Journal of Object Technology 3(6) (2004).

[7]

Jacobs, B., Piessens, F.: Verification of programs with inspector methods. In: FT-FJP (2006).

[8]

Müller, P.: Modular Specification and Verification of Object-Oriented Programs. PhD thesis, FernUniversität Hagen (2001).

[9]

Dhara, K.K., Leavens, G.T.: Forcing behavioral subtyping through specification inheritance. In: ICSE (1996).

Digital Library

[10]

Barnett, M., Leino, K.R.M., Schulte, W.: The spec# programming system: An overview. In: Barthe, G., Burdy, L., Huisman, M., Lanet, J.-L., Muntean, T. (eds.) CASSIS 2004. LNCS, vol. 3362, Springer, Heidelberg (2005).

Digital Library

[11]

Leino, K.R.M., Müller, P.: Object invariants in dynamic contexts. In: Odersky, M. (ed.) ECOOP 2004. LNCS, vol. 3086, Springer, Heidelberg (2004).

[12]

Barnett, M., Naumann, D.A.: Friends need a bit more: Maintaining invariants over shared state. In: Kozen, D. (ed.) MPC 2004. LNCS, vol. 3125, Springer, Heidelberg (2004).

[13]

Jacobs, B., Piessens, F.: Inspector methods for state abstraction. Journal of Object Technology 6(5) (2007).

[14]

Darvas, A., Leino, K.R.M.: Practical reasoning about invocations and implementations of pure methods. In: Dwyer, M.B., Lopes, A. (eds.) FASE 2007. LNCS, vol. 4422, Springer, Heidelberg (2007).

Digital Library

[15]

Leino, K.R.M., Müller., P.: A verification methodology for model fields. In: Sestoft, P. (ed.) ESOP 2006. LNCS, vol. 3924, Springer, Heidelberg (2006).

Digital Library

[16]

Parkinson, M.: Local Reasoning for Java. PhD thesis, University of Cambridge (2005).

[17]

Parkinson, M., Bierman, G.: Separation logic and abstraction. In: POPL (2005).

Digital Library

[18]

Leino, K.R.M., Poetzsch-Heffter, A., Zhou, Y.: Using data groups to specify and check side effects. In: PLDI (2002).

Digital Library

[19]

Banerjee, A., Naumann, D.A., Rosenberg, S.: Regional logic for local reasoning about global invariants. (Unpublished, 2007).

Cited By

Albert EBubel RGenaim SHähnle RPuebla GRomán-Díez G(2016)A formal verification framework for static analysisSoftware and Systems Modeling (SoSyM)10.1007/s10270-015-0476-y15:4(987-1012)Online publication date: 1-Oct-2016
https://dl.acm.org/doi/10.1007/s10270-015-0476-y
Smans JJacobs BPiessens F(2013)VeriFast for javaAliasing in Object-Oriented Programming10.5555/2554511.2554531(407-442)Online publication date: 1-Jan-2013
https://dl.acm.org/doi/10.5555/2554511.2554531
Banerjee ANaumann DRosenberg S(2013)Local Reasoning for Global Invariants, Part IJournal of the ACM10.1145/248598260:3(1-56)Online publication date: 1-Jun-2013
https://dl.acm.org/doi/10.1145/2485982
Show More Cited By

Recommendations

Automatic predicate abstraction of C programs
PLDI '01: Proceedings of the ACM SIGPLAN 2001 conference on Programming language design and implementation

Model checking has been widely successful in validating and debugging designs in the hardware and protocol domains. However, state-space explosion limits the applicability of model checking tools, so model checkers typically operate on abstractions of ...
Automatic predicate abstraction of C programs

Model checking has been widely successful in validating and debugging designs in the hardware and protocol domains. However, state-space explosion limits the applicability of model checking tools, so model checkers typically operate on abstractions of ...
Action Language verifier: an infinite-state model checker for reactive software specifications

Action Language is a specification language for reactive software systems. In this paper, we present the syntax and the semantics of the Action Language and we also present an infinite-state symbolic model checker called Action Language Verifier (ALV) ...

Comments

Information & Contributors

Information

Published In

cover image Guide Proceedings

FASE'08/ETAPS'08: Proceedings of the Theory and practice of software, 11th international conference on Fundamental approaches to software engineering

March 2008

429 pages

ISBN:3540787429

Editors:
José Luiz Fiadeiro
University of Leicester, Department of Computer Science, Leicester, UK
,
Paola Inverardi
Università degli Studi l'Aquila, Dipartimento di Informatica, L'Aquila, AQ, Italy

Publisher

Springer-Verlag

Berlin, Heidelberg

Publication History

Published: 29 March 2008

Qualifiers

Article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

14
Total Citations
View Citations
4
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 16 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Albert EBubel RGenaim SHähnle RPuebla GRomán-Díez G(2016)A formal verification framework for static analysisSoftware and Systems Modeling (SoSyM)10.1007/s10270-015-0476-y15:4(987-1012)Online publication date: 1-Oct-2016
https://dl.acm.org/doi/10.1007/s10270-015-0476-y
Smans JJacobs BPiessens F(2013)VeriFast for javaAliasing in Object-Oriented Programming10.5555/2554511.2554531(407-442)Online publication date: 1-Jan-2013
https://dl.acm.org/doi/10.5555/2554511.2554531
Banerjee ANaumann DRosenberg S(2013)Local Reasoning for Global Invariants, Part IJournal of the ACM10.1145/248598260:3(1-56)Online publication date: 1-Jun-2013
https://dl.acm.org/doi/10.1145/2485982
Banerjee ANaumann D(2013)Local Reasoning for Global Invariants, Part IIJournal of the ACM10.1145/248598160:3(1-73)Online publication date: 1-Jun-2013
https://dl.acm.org/doi/10.1145/2485981
Hatcliff JLeavens GLeino KMüller PParkinson M(2012)Behavioral interface specification languagesACM Computing Surveys10.1145/2187671.218767844:3(1-58)Online publication date: 14-Jun-2012
https://dl.acm.org/doi/10.1145/2187671.2187678
Smans JJacobs BPiessens F(2012)Implicit dynamic framesACM Transactions on Programming Languages and Systems10.1145/2160910.216091134:1(1-58)Online publication date: 4-May-2012
https://dl.acm.org/doi/10.1145/2160910.2160911
Albert EBubel RGenaim SHähnle RRomán-Díez G(2012)Verified resource guarantees for heap manipulating programsProceedings of the 15th international conference on Fundamental Approaches to Software Engineering10.1007/978-3-642-28872-2_10(130-145)Online publication date: 24-Mar-2012
https://dl.acm.org/doi/10.1007/978-3-642-28872-2_10
Schmitt PUlbrich MWeiß B(2010)Dynamic frames in java dynamic logicProceedings of the 2010 international conference on Formal verification of object-oriented software10.5555/1949303.1949313(138-152)Online publication date: 28-Jun-2010
https://dl.acm.org/doi/10.5555/1949303.1949313
Leino K(2010)DafnyProceedings of the 16th international conference on Logic for programming, artificial intelligence, and reasoning10.5555/1939141.1939161(348-370)Online publication date: 25-Apr-2010
https://dl.acm.org/doi/10.5555/1939141.1939161
Rosenberg SBanerjee ANaumann D(2010)Local reasoning and dynamic framing for the composite pattern and its clientsProceedings of the Third international conference on Verified software: theories, tools, experiments10.5555/1884866.1884887(183-198)Online publication date: 16-Aug-2010
https://dl.acm.org/doi/10.5555/1884866.1884887
Show More Cited By

View Options

View options

Media

Figures

Other

Tables

View Table of Contents