Towards imperative modules: reasoning about invariants and sharing of mutable state
|
|
- Julianna Evans
- 6 years ago
- Views:
Transcription
1 Towards imperative modules: reasoning about invariants and sharing of mutable state David A. Naumann Joint work with Mike Barnett and Anindya Banerjee Stevens Institute of Technology Supported by NSF CCR , CCF , and Microsoft. NJPLS 1 Oct 2004 / 1
2 Outline Difficulty in reasoning about object invariants due to callbacks and heap sharing programmer s view logician s view The boogie and friends disciplines: state based encapsulation (with Mike Barnett [LICS]) Representation independence (with Anindya Banerjee) Related work and Phd/postdoc advert NJPLS 1 Oct 2004 / 2
3 Programmer s intro: object invariants class Subject { private x,y: int := 0,1; invariant I(self) where I is defined by I(o) = o.x method m() { self.x := self.x+1; o.y self.y := self.y+1; }... } NJPLS 1 Oct 2004 / 3
4 Programmer s intro: object invariants class Subject { private x,y: int := 0,1; obs: Observer :=... ; invariant I(self) where I is defined by I(o) = o.x method m() { self.x := self.x+1; obs.notify(); self.y := self.y+1; }... } o.y NJPLS 1 Oct 2004 / 3-a
5 Programmer s intro: object invariants class Subject { private x,y: int := 0,1; obs: Observer :=... ; invariant I(self) where I is defined by I(o) = o.x method m() { self.x := self.x+1; obs.notify(); self.y := self.y+1; }... } class Observer { z: Subject :=... ; method notify() { z.m(); }... } o.y NJPLS 1 Oct 2004 / 3-b
6 Programmer s intro: object invariants class Subject { private x,y: int := 0,1; obs: Observer :=... ; invariant I(self) where I is defined by I(o) = o.x method m() { self.x := self.x+1; obs.notify(); self.y := self.y+1; }... } class Observer { z: Subject :=... ; method notify() { z.m(); }... } o.y When should I hold? NJPLS 1 Oct 2004 / 3-c
7 Programmer s intro (2): sharing class Subject2 { private x: Integer := new Integer(0); private y: Integer := new Integer(1); invariant I(self) where I(o) = o.x.val method m() { self.x.incr(); self.y.incr(); } o.y.val } NJPLS 1 Oct 2004 / 4
8 Programmer s intro (2): sharing class Subject2 { private x: Integer := new Integer(0); private y: Integer := new Integer(1); invariant I(self) where I(o) = o.x.val o.y.val method m() { self.x.incr(); self.y.incr(); } method leak(): Integer { result := x; } } class Main { s: Subject2; i: Integer;... i := s.leak(); i.incr(); s.m()... } NJPLS 1 Oct 2004 / 4-a
9 Programmer s intro (2): sharing class Subject2 { private x: Integer := new Integer(0); private y: Integer := new Integer(1); invariant I(self) where I(o) = o.x.val method m() { self.x.incr(); self.y.incr(); } method leak(): Integer { result := x; } } class Main { s: Subject2; i: Integer;... i := s.leak(); i.incr(); s.m()... } o.y.val How can we encapsulate not just fields but also referenced objects? NJPLS 1 Oct 2004 / 4-b
10 I Logician s intro P Q I I is encapsulated for P call Q Declaration:. Specification P fields; I depends on the internal representation. Q involves public NJPLS 1 Oct 2004 / 5
11 I Q Logician s intro P Q I I is encapsulated for P call Q Declaration:. Specification P fields; I depends on the internal representation. Q involves public P does not interfere* with I P I Q I NJPLS 1 Oct 2004 / 5-a
12 I Q Logician s intro P Q I I is encapsulated for P call Q Declaration:. Specification P fields; I depends on the internal representation. Q involves public P does not interfere* with I P I Q I * does not write variables read in I (hazard: aliased vars) * does not update objects read in I (hazard: heap sharing) NJPLS 1 Oct 2004 / 5-b
13 call call Logicians intro (2) R R P P P I Q. Q I Q NJPLS 1 Oct 2004 / 6
14 call Logicians intro (2) R P R I P I R I no interference P P I Q I call I Q. I Q I NJPLS 1 Oct 2004 / 6-a
15 Q call call Logicians intro (2) R R R P R I I P I R I no interference P P I Q I call I Q. I Q I Q I NJPLS 1 Oct 2004 / 6-b
16 Q call call Logicians intro (2) R R R P R I I P I R I no interference P P I Q I Q I How generalize to multiple instantiation, i.e., I call I Q. I Q I for all? NJPLS 1 Oct 2004 / 6-c
17 Logicians intro (2) R R P R I R no interference I P I R I call call Q P P I Q I I I. Q call Q I Q I How generalize to multiple instantiation, i.e., I for all? What about outcalls, i.e. method invocations on in other objects, which may lead to reentrant callbacks? NJPLS 1 Oct 2004 / 6-d
18 Logicians intro (2) R R P R I R no interference I P I R I call call Q P P I Q I I I. Q call Q I Q I How generalize to multiple instantiation, i.e., I for all? What about outcalls, i.e. method invocations on in other objects, which may lead to reentrant callbacks? How express absence of interference due to heap sharing? NJPLS 1 Oct 2004 / 6-e
19 An assertion-based discipline Problems: due to reentrant callbacks, precondition P I for is unsound unless I re-established before outcalls NJPLS 1 Oct 2004 / 7
20 An assertion-based discipline Problems: due to reentrant callbacks, precondition P I for is unsound unless I re-established before outcalls need to protect I Subject from interference by code in other classes and by other instances of Subject NJPLS 1 Oct 2004 / 7-a
21 An assertion-based discipline Problems: due to reentrant callbacks, precondition P I for is unsound unless I re-established before outcalls need to protect I Subject from interference by code in other classes and by other instances of Subject Solution uses a single everywhere-invariant, PI. PI P Rule:. P Q Q NJPLS 1 Oct 2004 / 7-b
22 An assertion-based discipline Problems: due to reentrant callbacks, precondition P I for is unsound unless I re-established before outcalls need to protect I Subject from interference by code in other classes and by other instances of Subject Solution uses a single everywhere-invariant, PI. PI P Rule:. Handles transfer and sharing of P objects across encapsulation boundaries. Can use with standard logics. Q Q NJPLS 1 Oct 2004 / 7-c
23 Auxiliary field to make explicit when invariant holds: boolean Maintain program invariant PI Itype NJPLS 1 Oct 2004 / 8
24 Auxiliary field to make explicit when invariant holds: boolean Maintain program invariant PI Itype class Subject {... invariant I method m() { (self) where I (o) = o.x assert self.inv (* precondition *) unpack self; (* self.inv := false *) self.x := self.x+1; obs.notify(); self.y := self.y+1; (* I(self) *) pack self; (* self.inv := true *) }... } class Main... method notify() { assert z.inv?; z.m(); } o.y NJPLS 1 Oct 2004 / 8-a
25 PI Auxiliary field to make explicit when invariant holds: boolean Maintain program invariant PI Itype class Subject {... invariant I method m() { (self) where I (o) = o.x assert self.inv (* precondition *) unpack self; (* self.inv := false *) self.x := self.x+1; obs.notify(); self.y := self.y+1; (* I(self) *) pack self; (* self.inv := true *) }... } class Main... method notify() { assert z.inv?; z.m(); } o.y Absence of interf., as a precond.: PI NJPLS 1 Oct 2004 / 8-b
26 Auxiliary field to delimit heap dependence of invariant: Def: iff either or. NJPLS 1 Oct 2004 / 9
27 Auxiliary field to delimit heap dependence of invariant: Def: iff either or. Def: I is admissible iff when I depends on then either or. NJPLS 1 Oct 2004 / 9-a
28 Auxiliary field to delimit heap dependence of invariant: Def: iff either or. Def: I is admissible iff when I depends on then either or. Absence of interference, as a precondition: PI PI Ownership provides stateful encapsulation: control is inside the boundary for. means NJPLS 1 Oct 2004 / 9-b
29 Last auxiliary field for ownership discipline: boolean PI Itype NJPLS 1 Oct 2004 / 10
30 Last auxiliary field for ownership discipline: boolean PI Itype Absence of interf., as a precond.: PI PI NJPLS 1 Oct 2004 / 10-a
31 with Last auxiliary field for ownership discipline: boolean PI Itype Absence of interf., as a precond.: Precondition and effect of unpack assert := false; forall ; : do PI PI := false; NJPLS 1 Oct 2004 / 10-b
32 with with Last auxiliary field for ownership discipline: boolean PI Itype Absence of interf., as a precond.: Precondition and effect of unpack assert ; := false; forall Precondition and effect of pack assert Itype := true; forall ; : : do do PI PI := false; := true; NJPLS 1 Oct 2004 / 10-c
33 PI Ownership transfer PI Special command setowner to highlight that it only manipulates auxiliary state (like unpack/pack. State-based encapsulation (vs. type systems): avoids restriction on existence or reading of references allows transfer of objects across boundaries examples: lexer/stream, AST (into); tasks (between); database connections (in and out) NJPLS 1 Oct 2004 / 11
34 PI Q Q Stateful encapsulation I. Def: is properly annotated iff each pack, unpack, setowner, and field update has stipulated precondition. Theorem: PI for any properly annotated Justifies rule: PI P P Proof: using a straightforward denotational semantics for a sequential language with mutually recursive class declarations and methods etc. NJPLS 1 Oct 2004 / 12
35 Stateful encapsulation II friends. A List owns its nodes. A node does not own its neighbors. class List { head: ListNode; invariant self.head=null class ListNode { next, prev: ListNode; invariant self.next=null (self.next.prev=self self.head.prev=null;... } self.next.own=self.own);... } NJPLS 1 Oct 2004 / 13
36 Stateful encapsulation II friends. A List owns its nodes. A node does not own its neighbors. class List { head: ListNode; invariant self.head=null class ListNode { next, prev: ListNode; invariant self.next=null (self.next.prev=self self.head.prev=null;... } self.next.own=self.own);... } Decentralized invariants express acyclicity without induction. Well behaved interaction but not ownership. NJPLS 1 Oct 2004 / 13-a
37 depends on Absence of interference, as a precondition: I I NJPLS 1 Oct 2004 / 14
38 depends on Absence of interference, as a precondition: I I Auxiliary field for friendship discipline: set of I NJPLS 1 Oct 2004 / 14-a
39 depends on depends on Absence of interference, as a precondition: I I Auxiliary field for friendship discipline: set of I Admissibility: when I then either, or for some declared pivot and, NJPLS 1 Oct 2004 / 14-b
40 depends on depends on Absence of interference, as a precondition: I I Auxiliary field for friendship discipline: set of I Admissibility: when I then either, or for some declared pivot and, Abstract from I Obligation: I U as U. I NJPLS 1 Oct 2004 / 14-c
41 Program equivalence: two-state invars class Subject2 { private x: Integer := new Integer(0); private y: Integer := new Integer(1); invariant I(self) where I(o) = o.x.val o.y.val method m() { self.x.incr(); self.y.incr(); } class Subject2 { // Alternate version private x: int := 0; private z: Integer := new Integer(1); invariant I(self) where I(o) = 0 o.z.val method m() { self.x := self.x + 1; } Coupling relation: o.x = o.x.val o.z = o.y.val o.x.val NJPLS 1 Oct 2004 / 15
42 Towards simulation: admissibility revisited Let be an instance of the class to be revised. Partition, where and the set of objects transitively owned by in. Then I iff I. NJPLS 1 Oct 2004 / 16
43 Towards simulation: admissibility revisited Let be an instance of the class to be revised. Partition, where and the set of objects transitively owned by in. Then I iff I. PI implies: If we choose top-level instances of in, have for I for all where. NJPLS 1 Oct 2004 / 16-a
44 Coupling for two versions of Heaps coupled just if there are same-length partitions NJPLS 1 Oct 2004 / 17
45 by a given coupling. Coupling for two versions of Heaps coupled just if there are same-length partitions such that for each pair, relates to and implies NJPLS 1 Oct 2004 / 17-a
46 Coupling for two versions of Heaps coupled just if there are same-length partitions such that for each pair, and implies relates to by a given coupling. Moreover (modulo bijective renaming of locations). corresponds to NJPLS 1 Oct 2004 / 17-b
47 Coupling for two versions of Heaps coupled just if there are same-length partitions such that for each pair, and implies relates to by a given coupling. Moreover (modulo bijective renaming corresponds to of locations). Identity on visible state (fields in, interface of ). NJPLS 1 Oct 2004 / 17-c
48 Abstraction theorem Theorem If the induced coupling is a simulation, i.e., is preserved by the methods of the revised class, then it is preserved by all contexts. If coupling holds at boundaries of everywhere that does. then outside it holds NJPLS 1 Oct 2004 / 18
49 Abstraction theorem Theorem If the induced coupling is a simulation, i.e., is preserved by the methods of the revised class, then it is preserved by all contexts. If coupling holds at boundaries of everywhere that does. then outside it holds Reentrant callbacks and invariants: a method that does not require cannot rely on I; that s all. NJPLS 1 Oct 2004 / 18-a
50 Abstraction theorem Theorem If the induced coupling is a simulation, i.e., is preserved by the methods of the revised class, then it is preserved by all contexts. If coupling holds at boundaries of everywhere that does. then outside it holds Reentrant callbacks and invariants: a method that does not require cannot rely on I; that s all. Reentrant callbacks and simulation: a method that does not require must still preserve how? (vs. invariant case where some precondition can help)? Need modifies spec. NJPLS 1 Oct 2004 / 18-b
51 (e.g., callbacks from notify can inspect the Subject but not alter the datastruct tracking Observers). NJPLS 1 Oct 2004 / 19
52 (e.g., callbacks from notify can inspect the Subject but not alter the datastruct tracking Observers). NJPLS 1 Oct 2004 / 19-a
53 (e.g., callbacks from notify can inspect the Subject but not alter the datastruct tracking Observers). NJPLS 1 Oct 2004 / 19-b
54 Conclusion Discipline for control of dependence for object invariants. Controls use of pointers rather than their existence. Handles difficult design patterns that are common in practice. No restrictions on heap structure. No committment to particular program logic or verification system. Uses verification conditions; not special type annotation but not fully automated. NJPLS 1 Oct 2004 / 20
55 Related work Leino et al [JoT, ECOOP04, CASSIS04] Boogie, Spec# with concurrency O Hearn et al [POPL04]; Mijajlović et al [FSTTCS 04] static modularity for separation logic Parkinson & Bierman [POPL05] instantiable abstraction in sep. logic using scope of predicate definitions Hongseok Yang [TCS?] relational sep. logic full logic and mechanization Pierik and de Boer NJPLS 1 Oct 2004 / 21
56 Future work precise comparison with Separation Logic: P Q P Q P I Q I P I implementation and case studies Spec# project friends and subclassing; generalization to multi-class patterns Barnett and Naumann integrate with ownership typing, extend simu to concurrent Banerjee and Naumann machine check soundness proof Naumann Q I NJPLS 1 Oct 2004 / 22
57 Advert Seeking PhD student or postdoc to develop these ideas in context of JML, a specification language used by ESC/Java and several other systems e.g. smartcard verif. (Joint project with Iowa State (Gary Leavens) and UFPE, Recife, Brazil.) NJPLS 1 Oct 2004 / 23
58 References Barnett, DeLine, Fähndrich, Leino, Wolfram Schulte: Verification of object-oriented programs with invariants (Journal of Object Technology 04) Leino and Müller: Object invariants in dynamic contexts (ECOOP 04) Barnett and D.N.: Friends need a bit more (MPC 04) O Hearn, Yang, Reynolds: Separation and Info Hiding (POPL 04) Banerjee and D.N.: State based ownership and encapsulation for generic classes NJPLS 1 Oct 2004 / 24
Representation Independence, Confinement and Access Control
Representation Independence, Confinement and Access Control Anindya Banerjee and David Naumann ab@cis.ksu.edu and naumann@cs.stevens-tech.edu Kansas State University and Stevens Institute of Technology
More informationRepresentation Independence, Confinement and Access Control
Representation Independence, Confinement and Access Control Anindya Banerjee and David Naumann ab@cis.ksu.edu and naumann@cs.stevens-tech.edu Kansas State University and Stevens Institute of Technology,
More informationReasoning about modules: data refinement and simulation
Reasoning about modules: data refinement and simulation David Naumann naumann@cs.stevens-tech.edu Stevens Institute of Technology Naumann - POPL 02 Java Verification Workshop p.1/17 Objectives of talk
More informationControlling Object Allocation Using Creation Guards
Controlling Object Allocation Using Creation Guards Cees Pierik 1, Dave Clarke 2, and Frank S. de Boer 1,2,3 1 ICS, Utrecht University, The Netherlands 2 CWI, Amsterdam, The Netherlands 3 LIACS, Leiden
More informationAssertion-Based Encapsulation, Object Invariants and Simulations
Assertion-Based Encapsulation, Object Invariants and Simulations David A. Naumann Department of Computer Science, Stevens Institute of Technology, Hoboken, NJ 07030, USA Abstract. In object-oriented programming,
More informationOn assertion-based encapsulation for object invariants and simulations
Under consideration for publication in Formal Aspects of Computing On assertion-based encapsulation for object invariants and simulations David A. Naumann 1 Department of Computer Science, Stevens Institute
More informationA verification methodology for model fields
A verification methodology for model fields K. Rustan M. Leino 1 and Peter Müller 2 1 Microsoft Research, leino@microsoft.com 2 ETH Zürich, peter.mueller@inf.ethz.ch Abstract. Model fields are specification-only
More informationReasoning about Object Structures Using Ownership
Reasoning about Object Structures Using Ownership Peter Müller ETH Zurich, Switzerland Peter.Mueller@inf.ethz.ch Abstract. Many well-established concepts of object-oriented programming work for individual
More informationModular verification of static class invariants
Modular verification of static class invariants K. Rustan M. Leino 1 and Peter Müller 2 1 Microsoft Research, Redmond, WA, USA, leino@microsoft.com 2 ETH Zürich, Switzerland, peter.mueller@inf.ethz.ch
More informationTowards imperative modules: Reasoning about invariants and sharing of mutable state (extended abstract)
Towards imperative modules: Reasoning about invariants and sharing of mutable state (extended abstract) David A. Naumann Stevens Institute of Technology naumann@cs.stevens-tech.edu Mike Barnett Microsoft
More informationLecture 4. Towards a Verifying Compiler: Data Abstraction
Lecture 4 Towards a Verifying Compiler: Data Abstraction W olfram Schulte Microsoft Research Formal Methods 2006 Purity, Model fields, Inconsistency Joint work with Rustan Leino, Mike Barnett, Manuel Fähndrich,
More informationObject Ownership in Program Verification
Object Ownership in Program Verification Werner Dietl 1 and Peter Müller 2 1 University of Washington wmdietl@cs.washington.edu 2 ETH Zurich peter.mueller@inf.ethz.ch Abstract. Dealing with aliasing is
More informationModular reasoning in object-oriented programming
Modular reasoning in object-oriented programming David A. Naumann Department of Computer Science, Stevens Institute of Technology naumann@cs.stevens.edu Abstract. Difficulties in reasoning about functional
More informationChapter 9 State Based Invariants and Object Allocation
Chapter 9 State Based Invariants and Object Allocation Sharing of objects is often necessary to increase the speed and reduce the resource demands of programs. A system that allocates too many objects
More informationJML tool-supported specification for Java Erik Poll Radboud University Nijmegen
JML tool-supported specification for Java Erik Poll Radboud University Nijmegen Erik Poll - JML p.1/41 Overview The specification language JML Tools for JML, in particular runtime assertion checking using
More informationTowards Imperative Modules: Reasoning about Invariants and Sharing of Mutable State
Towards Imperative Modules: Reasoning about Invariants and Sharing of Mutable State David A. Naumann a,1 a Stevens Institute of Technology Castle Point on Hudson, Hoboken, NJ 07030 USA Mike Barnett b b
More informationModular Verification with Shared Abstractions
Modular Verification with Shared Abstractions Uri Juhasz Noam Rinetzky Arnd Poetzsch-Heffter Mooly Sagiv Eran Yahav Tel Aviv University Tel Aviv University Universität Kaiserlautern Tel Aviv University
More information99.44% pure: Useful Abstractions in Specifications
99.44% pure: Useful Abstractions in Specifications Mike Barnett 0, David A. Naumann 1, Wolfram Schulte 0, and Qi Sun 1 0 Microsoft Research {mbarnett,schulte@microsoft.com 1 Stevens Institute of Technology
More informationVerifying JML specifications with model fields
Verifying JML specifications with model fields Cees-Bart Breunesse and Erik Poll Department of Computer Science, University of Nijmegen Abstract. The specification language JML (Java Modeling Language)
More informationVerification of Equivalent-Results Methods
Verification of Equivalent-Results Methods K. Rustan M. Leino and Peter Müller Microsoft Research, Redmond, WA, USA {leino,mueller@microsoft.com Abstract. Methods that query the state of a data structure
More informationVerification of Object-Oriented Programs with Invariants
Verification of Object-Oriented Programs with Invariants Dewan Ibtesham 05-03-2012 1 1 Introduction Reliability of computer programs is one of the most important tasks a programmer faces when he writes
More informationState Based Encapsulation for Modular Reasoning about Behavior-Preserving Refactorings
State Based Encapsulation for Modular Reasoning about Behavior-Preserving Refactorings Anindya Banerjee 1 and David A. Naumann 2 1 IMDEA Software Institute, Madrid, Spain 2 Stevens Institute of Technology,
More informationStatic program checking and verification
Chair of Software Engineering Software Engineering Prof. Dr. Bertrand Meyer March 2007 June 2007 Slides: Based on KSE06 With kind permission of Peter Müller Static program checking and verification Correctness
More informationThe Java Modeling Language JML
The Java Modeling Language JML Néstor Cataño ncatano@puj.edu.co Faculty of Engineering Pontificia Universidad Javeriana The Java Modelling Language JML p.1/47 Lecture Plan 1. An Introduction to JML 2.
More informationLocal Verification of Global Invariants in
Local Verification of Global Invariants in 1 Local Verification of Global Invariants in Concurrent Programs Ernie Cohen 1, Michal Moskal 2, Wolfram Schulte 2, Stephan Tobies 1 1 European Microsoft Innovation
More informationAn Automatic Verifier for Java-Like Programs Based on Dynamic Frames
An Automatic Verifier for Java-Like Programs Based on Dynamic Frames Jan Smans 1, Bart Jacobs 1, Frank Piessens 1, and Wolfram Schulte 2 1 Katholieke Universiteit Leuven, Belgium {jans,bartj,frank}@cs.kuleuven.be
More informationModular specification of frame properties in JML
CONCURRENCY PRACTICE AND EXPERIENCE Concurrency: Pract. Exper. 2002; 1:1 [Version: 2001/03/05 v2.01] Modular specification of frame properties in JML Peter Müller 1, Arnd Poetzsch-Heffter 2, and Gary T.
More informationVerification of Object-Oriented Programs with Invariants
Verification of Object-Oriented Programs with Invariants Mike Barnett, Robert DeLine, Manuel Fähndrich, K. Rustan M. Leino, and Wolfram Schulte Microsoft Research, Redmond, WA, USA {mbarnett,rdeline,maf,leino,schulte@microsoft.com
More informationHoare logic. WHILE p, a language with pointers. Introduction. Syntax of WHILE p. Lecture 5: Introduction to separation logic
Introduction Hoare logic Lecture 5: Introduction to separation logic In the previous lectures, we have considered a language, WHILE, where mutability only concerned program variables. Jean Pichon-Pharabod
More informationHoare logic. Lecture 5: Introduction to separation logic. Jean Pichon-Pharabod University of Cambridge. CST Part II 2017/18
Hoare logic Lecture 5: Introduction to separation logic Jean Pichon-Pharabod University of Cambridge CST Part II 2017/18 Introduction In the previous lectures, we have considered a language, WHILE, where
More informationSTEVENS. Stevens Institute of Technology. Ownership Confinement Ensures Representation Independence for Object-Oriented Programs
STEVENS Institute of Technology Ownership Confinement Ensures Representation Independence for Object-Oriented Programs Anindya Banerjee Computing and Information Science Kansas State University David A.
More informationThe Rule of Constancy(Derived Frame Rule)
The Rule of Constancy(Derived Frame Rule) The following derived rule is used on the next slide The rule of constancy {P } C {Q} {P R} C {Q R} where no variable assigned to in C occurs in R Outline of derivation
More informationState based ownership, reentrance, and encapsulation
State based ownership, reentrance, and encapsulation Anindya Banerjee 1 and David A. Naumann 2 1 Kansas State University, Manhattan KS 66506 USA ab@cis.ksu.edu 2 Stevens Institute of Technology, Hoboken
More informationThe Spec# Programming System: Challenges and Directions
The Spec# Programming System: Challenges and Directions Mike Barnett, Robert DeLine, Bart Jacobs, Manuel Fähndrich, K. Rustan M. Leino, Wolfram Schulte, and Herman Venter Microsoft Research, Redmond, WA,
More informationScalable Specification and Reasoning: Challenges for Program Logic
Scalable Specification and Reasoning: Challenges for Program Logic Peter W. O Hearn Queen Mary, University of London Abstract. If program verification tools are ever to be used widely, it is essential
More informationHoare triples. Floyd-Hoare Logic, Separation Logic
Hoare triples Floyd-Hoare Logic, Separation Logic 1. Floyd-Hoare Logic 1969 Reasoning about control Hoare triples {A} p {B} a Hoare triple partial correctness: if the initial state satisfies assertion
More informationInformation Hiding and Visibility in Interface Specifications
Information Hiding and Visibility in Interface Specifications Gary T. Leavens and Peter Müller TR #06-28 September 2006 Keywords: Information hiding, visibility, behavioral interface specification language,
More informationScalable Specification and Reasoning: Technical Challenges for Program Logic
Scalable Specification and Reasoning: Technical Challenges for Program Logic Peter W. O Hearn Queen Mary, University of London Abstract. If program verification tools are ever to be used widely, it is
More informationProgram Verification (6EC version only)
Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language
More informationA Re-Entrancy Analysis for Object Oriented Programs
A Re-Entrancy Analysis for Object Oriented Programs Manuel Fähndrich 1, Diego Garbervetsky 2, and Wolfram Schulte 1 1 Microsoft Research, Redmond, WA, USA {maf, schulte@microsoft.com 2 Departamento de
More informationSafe Concurrency for Aggregate Objects with Invariants
Safe Concurrency for Aggregate Objects with Invariants Bart Jacobs 0 K. Rustan M. Leino 1 Frank Piessens 0 Wolfram Schulte 1 0 Dept. of Computer Science Katholieke Universiteit Leuven Celestijnenlaan 200A
More informationWhy. an intermediate language for deductive program verification
Why an intermediate language for deductive program verification Jean-Christophe Filliâtre CNRS Orsay, France AFM workshop Grenoble, June 27, 2009 Jean-Christophe Filliâtre Why tutorial AFM 09 1 / 56 Motivations
More informationVerification of Multithreaded Object-Oriented Programs with Invariants
Verification of Multithreaded Object-Oriented Programs with Invariants Bart Jacobs K. Rustan M. Leino Dept. of Computer Science Microsoft Research Katholieke Universiteit Leuven One Microsoft Way Celestijnenlaan
More informationHoare Logic and Model Checking
Hoare Logic and Model Checking Kasper Svendsen University of Cambridge CST Part II 2016/17 Acknowledgement: slides heavily based on previous versions by Mike Gordon and Alan Mycroft Pointers Pointers and
More informationBehavioral Subtyping, Specification Inheritance, and Modular Reasoning
Computer Science Technical Reports Computer Science 9-3-2006 Behavioral Subtyping, Specification Inheritance, and Modular Reasoning Gary T. Leavens Iowa State University David A. Naumann Iowa State University
More informationLecture 5. Towards a Verifying Compiler: Multithreading
Lecture 5 Towards a Verifying Compiler: Multithreading W olfram Schulte Microsoft Research Formal Methods 2006 Race Conditions, Locks, Deadlocks, Invariants, Locklevels Access Sets Joint work with Rustan
More informationOutline. What is semantics? Denotational semantics. Semantics of naming. What is semantics? 2 / 21
Semantics 1 / 21 Outline What is semantics? Denotational semantics Semantics of naming What is semantics? 2 / 21 What is the meaning of a program? Recall: aspects of a language syntax: the structure of
More informationChapter 1. Introduction
1 Chapter 1 Introduction An exciting development of the 21st century is that the 20th-century vision of mechanized program verification is finally becoming practical, thanks to 30 years of advances in
More informationDepartment of Computer Science 226 Atanasoff Hall Iowa State University Ames, Iowa , USA
Modular Specification of Frame Properties in JML Peter Müller, Arnd Poetzsch-Heffter, and Gary T. Leavens TR #02-02a February 2002, Revised October 2002 Keywords: frame property, frame axiom, modifies
More informationVCC: A Practical System for Verifying Concurrent C
VCC: A Practical System for Verifying Concurrent C Ernie Cohen 1, Markus Dahlweid 2, Mark Hillebrand 3, Dirk Leinenbach 3, Michal Moskal 2, Thomas Santen 2, Wolfram Schulte 4 and Stephan Tobies 2 1 Microsoft
More informationSound reasoning about unchecked exceptions
Sound reasoning about unchecked exceptions Bart Jacobs 1 Peter Müller 2 Frank Piessens 1 1 Katholieke Universiteit Leuven Belgium {bartj,frank@cs.kuleuven.be 2 Microsoft Research, Redmond USA mueller@microsoft.com
More informationStack-based Access Control for Secure Information Flow
Stack-based Access Control for Secure Information Flow Anindya Banerjee and David A. Naumann ab@cis.ksu.edu, naumann@cs.stevens-tech.edu Kansas State University and Stevens Institute of Technology www.cis.ksu.edu/~ab,
More informationESC/Java2 Use and Features
ESC/Java2 Use and Features The ESC/Java2 tool David Cok, Joe Kiniry, Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2
More informationChecking Program Properties with ESC/Java
Checking Program Properties with ESC/Java 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich 1 ESC/Java A checker for Java programs Finds null pointers, array dereferences Checks Hoare logic
More informationESC/Java2 Use and Features
ESC/Java2 Use and Features David Cok, Joe Kiniry, Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2 & JML Tutorial
More informationHoare logic. A proof system for separation logic. Introduction. Separation logic
Introduction Hoare logic Lecture 6: Examples in separation logic In the previous lecture, we saw how reasoning about pointers in Hoare logic was problematic, which motivated introducing separation logic.
More informationVerifying Backwards Compatibility of Object-Oriented Libraries Using Boogie
Verifying Backwards Compatibility of Object-Oriented Libraries Using Boogie [Extended Abstract] ABSTRACT Yannick Welsch University of Kaiserslautern, Germany welsch@cs.uni-kl.de Proving that a library
More informationModular Verification of the Subject-Observer Pattern via Higher-Order Separation Logic
Modular Verification of the Subject-Observer Pattern via Higher-Order Separation Logic Neelakantan R. Krishnaswami, Jonathan Aldrich 1, and Lars Birkedal 2 1 Carnegie Mellon University, {neelk, aldrich}@cs.cmu.edu
More informationDafny: An Automatic Program Verifier for Functional Correctness Paper by K. Rustan M. Leino (Microsoft Research)
Dafny: An Automatic Program Verifier for Functional Correctness Paper by K. Rustan M. Leino (Microsoft Research) Presentation by Patrick Spettel Seminar: Research Topics in Software Engineering, Spring
More informationBOOGIE. Presentation by Itsik Hefez A MODULAR REUSABLE VERIFIER FOR OBJECT-ORIENTED PROGRAMS MICROSOFT RESEARCH
BOOGIE A MODULAR REUSABLE VERIFIER FOR OBJECT-ORIENTED PROGRAMS MICROSOFT RESEARCH Presentation by Itsik Hefez Introduction Boogie is an intermediate verification language, intended as a layer on which
More informationExceptions in Ownership Type Systems
Exceptions in Ownership Type Systems Werner Dietl and Peter Müller ETH Zürich, Switzerland {werner.dietl,peter.mueller@inf.ethz.ch http://www.sct.inf.ethz.ch/ Abstract. Ownership type systems are used
More informationVerifying the State Design Pattern using Object Propositions
Verifying the State Design Pattern using Object Propositions Ligia Nistor Computer Science Department Carnegie Mellon University Why verify programs? Verification vs. debugging Verification at compile
More informationAn Annotated Language
Hoare Logic An Annotated Language State and Semantics Expressions are interpreted as functions from states to the corresponding domain of interpretation Operators have the obvious interpretation Free of
More informationVerifying Java Programs Verifying Java Programs with KeY
Verifying Java Programs Verifying Java Programs with KeY Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
More informationVerifying Java Programs Verifying Java Programs with KeY
Verifying Java Programs Verifying Java Programs with KeY Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
More informationAdvances in Programming Languages
O T Y H Advances in Programming Languages APL8: ESC/Java2 David Aspinall (including slides by Ian Stark and material adapted from ESC/Java2 tutorial by David Cok, Joe Kiniry and Erik Poll) School of Informatics
More informationHiding local state in direct style: a higher-order anti-frame rule
1 / 65 Hiding local state in direct style: a higher-order anti-frame rule François Pottier January 28th, 2008 2 / 65 Contents Introduction Basics of the type system A higher-order anti-frame rule Applications
More informationFormal Methods for Java
Formal Methods for Java Lecture 15: Object Invariants Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg June 21, 2017 Jochen Hoenicke (Software Engineering) Formal Methods for Java
More informationPart II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs?
Part II. Hoare Logic and Program Verification Part II. Hoare Logic and Program Verification Dilian Gurov Props: Models: Specs: Method: Tool: safety of data manipulation source code logic assertions Hoare
More informationControlling Mutation and Aliases with Fractional Permissions
Controlling Mutation and Aliases with Fractional Permissions John Boyland University of Wisconsin- Milwaukee ECOOP 12 Outline of Session I. Fractional Permissions II. Applications III. Problems I. Fractional
More information6. Hoare Logic and Weakest Preconditions
6. Hoare Logic and Weakest Preconditions Program Verification ETH Zurich, Spring Semester 07 Alexander J. Summers 30 Program Correctness There are many notions of correctness properties for a given program
More informationFrom Event-B Models to Dafny Code Contracts
From Event-B Models to Dafny Code Contracts Mohammadsadegh Dalvandi, Michael Butler, Abdolbaghi Rezazadeh Electronic and Computer Science School, University of Southampton Southampton, United Kingdom {md5g11,mjb,ra3}@ecs.soton.ac.uk
More informationPractical Reasoning About Invocations and Implementations of Pure Methods
Practical Reasoning About Invocations and Implementations of Pure Methods Ádám Darvas 1 and K. Rustan M. Leino 2 1 ETH Zurich, Switzerland adam.darvas@inf.ethz.ch 2 Microsoft Research, Redmond, WA, USA
More informationStatic Lock Capabilities for Deadlock-Freedom
Static Lock Capabilities for Deadlock-Freedom Colin S. Gordon csgordon@cs.washington.edu University of Washington TLDI, January 28, 2012 Joint work with Michael D. Ernst and Dan Grossman Colin S. Gordon
More informationBehavioral Subtyping is Equivalent to Modular Reasoning for Object-oriented Programs
Computer Science Technical Reports Computer Science 12-22-2006 Behavioral Subtyping is Equivalent to Modular Reasoning for Object-oriented Programs Gary T. Leavens Iowa State University David A. Naumann
More informationSMT-Based Modular Analysis of Sequential Systems Code
SMT-Based Modular Analysis of Sequential Systems Code Shuvendu K. Lahiri Microsoft Research Abstract. In this paper, we describe a few challenges that accompany SMTbased precise verification of systems
More informationESC/Java2 extended static checking for Java Erik Poll Radboud University Nijmegen
ESC/Java2 extended static checking for Java Erik Poll Radboud University Nijmegen Erik Poll - JML p.1/19 Extended static checker for Java ESC/Java by Rustan Leino et.al. Extension ESC/Java2 by David Cok
More informationCompilation and Program Analysis (#11) : Hoare triples and shape analysis
Compilation and Program Analysis (#11) : Hoare triples and shape analysis Laure Gonnord http://laure.gonnord.org/pro/teaching/capm1.html Laure.Gonnord@ens-lyon.fr Master 1, ENS de Lyon dec 2017 Inspiration
More informationConcurrent Programming Lecture 3
Concurrent Programming Lecture 3 3rd September 2003 Atomic Actions Fine grain atomic action We assume that all machine instructions are executed atomically: observers (including instructions in other threads)
More informationJava Modelling Language (JML) References
Java Modelling Language (JML) References G. T. Leavens and Y. Cheon. Design by Contract with JML, August 2005. L. Burdy, Y. Cheon, D. Cok, M. Ernst, J. Kiniry, G. T. Leavens, K. R. M. Leino, and E. Poll.
More informationA Gentle Introduction to Program Analysis
A Gentle Introduction to Program Analysis Işıl Dillig University of Texas, Austin January 21, 2014 Programming Languages Mentoring Workshop 1 / 24 What is Program Analysis? Very broad topic, but generally
More informationModular Verification of Higher-Order Methods with Mandatory Calls Specified by Model Programs
Computer Science Technical Reports Computer Science 4-2007 Modular Verification of Higher-Order Methods with Mandatory Calls Specified by Model Programs Steve M. Shaner Iowa State University, smshaner@mac.com
More informationObservational purity and encapsulation
Theoretical Computer Science 376 (2007) 205 224 www.elsevier.com/locate/tcs Observational purity and encapsulation David A. Naumann Department of Computer Science, Stevens Institute of Technology, Castle
More informationMaintaining Invariants Through Object Coupling Mechanisms
Maintaining Invariants Through Object Coupling Mechanisms Eric Kerfoot Steve McKeever Oxford University Computing Laboratory {eric.kerfoot, steve.mckeever}@comlab.ox.ac.uk Abstract Object invariants are
More informationESC/Java2 vs. JMLForge. Juan Pablo Galeotti, Alessandra Gorla, Andreas Rau Saarland University, Germany
ESC/Java2 vs. JMLForge Juan Pablo Galeotti, Alessandra Gorla, Andreas Rau Saarland University, Germany ESC/Java2: the formula is built using Dijsktra s Weakes precondition. Automatic theorem prover: Simplify
More informationA Static Analysis to Detect Re-Entrancy in Object Oriented Programs
Vol. 7, No. 5, Special Issue: Workshop on FTfJP 07, June 2008 A Static Analysis to Detect Re-Entrancy in Object Oriented Programs Manuel Fähndrich, Microsoft Research, Redmond, WA, USA Diego Garbervetsky,
More informationCall invariants. Shuvendu K. Lahiri and Shaz Qadeer. Microsoft Research
Call invariants Shuvendu K. Lahiri and Shaz Qadeer Microsoft Research Abstract. Program verifiers based on first-order theorem provers model the program heap as a collection of mutable maps. In such verifiers,
More informationVerifying Java Programs with KeY
Verifying Java Programs with KeY Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationBoogie Meets Regions: a Verification Experience Report
Boogie Meets Regions: a Verification Experience Report Anindya Banerjee 1, Mike Barnett 2, and David A. Naumann 3 1 Kansas State University, Manhattan KS 66506 USA 2 Microsoft Research, Redmond WA 98052
More informationSeparation Logic Tutorial
Separation Logic Tutorial (To appear in Proceedings of ICLP 08) Peter O Hearn Queen Mary, University of London Separation logic is an extension of Hoare s logic for reasoning about programs that manipulate
More informationAdvanced JML. and more tips and pitfalls. David Cok, Joe Kiniry, and Erik Poll
Advanced JML and more tips and pitfalls David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2
More informationInspector Methods for State Abstraction
Vol. 6, No. 5, Special Issue: Workshop on FTfJP, ECOOP 2006, Juni 2007 Inspector Methods for State Abstraction Bart Jacobs, Frank Piessens, Katholieke Universiteit Leuven, Belgium Most classes in an object-oriented
More informationJML Class Specifications The Java Modeling Language (Part 2) A Java Class
JML Class Specifications The Java Modeling Language (Part 2) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria
More informationAn Experimental Evaluation of Deliberate Unsoundness in a Static Program Analyzer
An Experimental Evaluation of Deliberate Unsoundness in a Static Program Analyzer Maria Christakis, Peter Müller, and Valentin Wüstholz Department of Computer Science ETH Zurich, Switzerland {maria.christakis,
More informationFrom IMP to Java. Andreas Lochbihler. parts based on work by Gerwin Klein and Tobias Nipkow ETH Zurich
From IMP to Java Andreas Lochbihler ETH Zurich parts based on work by Gerwin Klein and Tobias Nipkow 2015-07-14 1 Subtyping 2 Objects and Inheritance 3 Multithreading 1 Subtyping 2 Objects and Inheritance
More informationMain Goal. Language-independent program verification framework. Derive program properties from operational semantics
Main Goal Language-independent program verification framework Derive program properties from operational semantics Questions: Is it possible? Is it practical? Answers: Sound and complete proof system,
More informationSpecification and verification challenges for sequential object-oriented programs
Computer Science Technical Reports Computer Science 8-2006 Specification and verification challenges for sequential object-oriented programs Gary T. Leavens Iowa State University Rustan M. Leino Microsoft
More informationThe Java Modeling Language (Part 2)
The Java Modeling Language (Part 2) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
More informationAn Approach to Behavioral Subtyping Based on Static Analysis
TACoS 04 Preliminary Version An Approach to Behavioral Subtyping Based on Static Analysis Francesco Logozzo 1 STIX - École Polytechnique F-91128 Palaiseau, France Abstract In mainstream object oriented
More informationRecap. Juan Pablo Galeotti,Alessandra Gorla, Software Engineering Chair Computer Science Saarland University, Germany
Recap Juan Pablo Galeotti,Alessandra Gorla, Software Engineering Chair Computer Science Saarland University, Germany 30% projects (10% each) At least 50% threshold for exam admittance Groups of 2 70% final
More information