Formale Entwicklung objektorientierter Software
|
|
|
- Myles Melton
- 5 years ago
- Views:
Transcription
1 Formale Entwicklung objektorientierter Software Praktikum im Wintersemester 2008/2009 Prof. P. H. Schmitt Christian Engel, Benjamin Weiß Institut für Theoretische Informatik Universität Karlsruhe 5. November 2008
2 More on JML Formale Entwicklung objektorientierter Software 5. November / 12
3 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): Formale Entwicklung objektorientierter Software 5. November / 12
4 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition Formale Entwicklung objektorientierter Software 5. November / 12
5 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Formale Entwicklung objektorientierter Software 5. November / 12
6 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Formale Entwicklung objektorientierter Software 5. November / 12
7 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Natural language specs are very important Formale Entwicklung objektorientierter Software 5. November / 12
8 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Natural language specs are very important But this course s focus: formal specifications, i.e., contracts described in a mathematically precise language (JML) Formale Entwicklung objektorientierter Software 5. November / 12
9 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Natural language specs are very important But this course s focus: formal specifications, i.e., contracts described in a mathematically precise language (JML) higher degree of precision Formale Entwicklung objektorientierter Software 5. November / 12
10 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Natural language specs are very important But this course s focus: formal specifications, i.e., contracts described in a mathematically precise language (JML) higher degree of precision automation of program analysis of various kinds (runtime assertion checking, static verification) Formale Entwicklung objektorientierter Software 5. November / 12
11 Design by Contract Idea Specifications fix a contract between caller and callee of a method (between client and implementor of a module): If caller guarantees precondition then callee guarantees certain outcome Interface documentation, blame assignment Natural language specs are very important But this course s focus: formal specifications, i.e., contracts described in a mathematically precise language (JML) higher degree of precision automation of program analysis of various kinds (runtime assertion checking, static verification) Errors in specifications are at least as common as errors in code, but their discovery gives deep insights in (mis)conceptions of the system Formale Entwicklung objektorientierter Software 5. November / 12
12 JML Annotations public requires pin == ensures public void enterpin (int pin) {... Formale Entwicklung objektorientierter Software 5. November / 12
13 JML Annotations public requires pin == ensures public void enterpin (int pin) {... Java comments as first character are JML specifications Formale Entwicklung objektorientierter Software 5. November / 12
14 JML Annotations public requires pin == ensures public void enterpin (int pin) {... Java comments as first character are JML specifications Within a JML annotation, is ignored: if it is the first (non-white) character in the line Formale Entwicklung objektorientierter Software 5. November / 12
15 JML Annotations public requires pin == ensures public void enterpin (int pin) {... Java comments as first character are JML specifications Within a JML annotation, is ignored: if it is the first (non-white) character in the line if it is the last character before */. Formale Entwicklung objektorientierter Software 5. November / 12
16 JML Annotations public requires pin == ensures public void enterpin (int pin) {... Java comments as first character are JML specifications Within a JML annotation, is ignored: if it is the first (non-white) character in the line if it is the last character before */. The s are not required, but it s a convention to use them. Formale Entwicklung objektorientierter Software 5. November / 12
17 JML Annotations public requires pin == ensures public void enterpin (int pin) {... //hello! Java comments as first character are JML specifications Within a JML annotation, is ignored: if it is the first (non-white) character in the line if it is the last character before */. The s are not required, but it s a convention to use them. JML specifications may themselves contain comments Formale Entwicklung objektorientierter Software 5. November / 12
18 Method Contracts requires assignable diverges ensures signals_only signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
19 Method Contracts requires r; //what is the caller s assignable diverges ensures signals_only signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
20 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges ensures signals_only signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
21 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures signals_only signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
22 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
23 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only E1,...,En; //what exc-types may be signals(e e) T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
24 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only E1,...,En; //what exc-types may be signals(e e) s; //what must hold when an E is T m(...); Formale Entwicklung objektorientierter Software 5. November / 12
25 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only E1,...,En; //what exc-types may be signals(e e) s; //what must hold when an E is T m(...); Abbreviations normal behavior = signals(exception) false; Formale Entwicklung objektorientierter Software 5. November / 12
26 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only E1,...,En; //what exc-types may be signals(e e) s; //what must hold when an E is T m(...); Abbreviations normal behavior = signals(exception) false; exceptional behavior = ensures false; Formale Entwicklung objektorientierter Software 5. November / 12
27 Method Contracts requires r; //what is the caller s assignable a; //which locations may be assigned by diverges d; //when may m ensures e; //what must hold on normal signals_only E1,...,En; //what exc-types may be signals(e e) s; //what must hold when an E is T m(...); Abbreviations normal behavior = signals(exception) false; exceptional behavior = ensures false; keyword also separates the contracts of a method Formale Entwicklung objektorientierter Software 5. November / 12
28 Class Invariants invariant i; Formale Entwicklung objektorientierter Software 5. November / 12
29 Class Invariants invariant i; can be placed anywhere in a class (or interface) Formale Entwicklung objektorientierter Software 5. November / 12
30 Class Invariants invariant i; can be placed anywhere in a class (or interface) express global consistency properties (not specific to a particular method) Formale Entwicklung objektorientierter Software 5. November / 12
31 Class Invariants invariant i; can be placed anywhere in a class (or interface) express global consistency properties (not specific to a particular method) must hold always (cf. visible state semantics, observed state semantics) Formale Entwicklung objektorientierter Software 5. November / 12
32 Class Invariants invariant i; can be placed anywhere in a class (or interface) express global consistency properties (not specific to a particular method) must hold always (cf. visible state semantics, observed state semantics) instance invariants can, static invariants cannot refer to this Formale Entwicklung objektorientierter Software 5. November / 12
33 Class Invariants invariant i; can be placed anywhere in a class (or interface) express global consistency properties (not specific to a particular method) must hold always (cf. visible state semantics, observed state semantics) instance invariants can, static invariants cannot refer to this default: instance within classes, static within interfaces Formale Entwicklung objektorientierter Software 5. November / 12
34 Expressions All Java expressions without side-effects Formale Entwicklung objektorientierter Software 5. November / 12
35 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence Formale Entwicklung objektorientierter Software 5. November / 12
36 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists Formale Entwicklung objektorientierter Software 5. November / 12
37 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max Formale Entwicklung objektorientierter Software 5. November / 12
38 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions Formale Entwicklung objektorientierter Software 5. November / 12
39 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions Formale Entwicklung objektorientierter Software 5. November / 12
40 Expressions All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions Example (\forall int i; 0<=i && i<\result.length; \result[i]>0) Formale Entwicklung objektorientierter Software 5. November / 12
41 Expressions Example All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions (\forall int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\forall int i; 0<=i && i<\result.length ==> \result[i]>0) Formale Entwicklung objektorientierter Software 5. November / 12
42 Expressions Example All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions (\forall int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\forall int i; 0<=i && i<\result.length ==> \result[i]>0) (\exists int i; 0<=i && i<\result.length; \result[i]>0) Formale Entwicklung objektorientierter Software 5. November / 12
43 Expressions Example All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions (\forall int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\forall int i; 0<=i && i<\result.length ==> \result[i]>0) (\exists int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\exists int i; 0<=i && i<\result.length && \result[i]>0) Formale Entwicklung objektorientierter Software 5. November / 12
44 Expressions Example All Java expressions without side-effects ==>, <==>: implication, equivalence \forall, \exists \num of, \sum, \product, \min, \max \old(...): referring to pre-state in postconditions \result: referring to return value in postconditions (\forall int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\forall int i; 0<=i && i<\result.length ==> \result[i]>0) (\exists int i; 0<=i && i<\result.length; \result[i]>0) equivalent to (\exists int i; 0<=i && i<\result.length && \result[i]>0) Formale Entwicklung objektorientierter Software 5. November / 12
45 assignable expressions Comma-separated list of: e.f (where f a field) Formale Entwicklung objektorientierter Software 5. November / 12
46 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) Formale Entwicklung objektorientierter Software 5. November / 12
47 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Formale Entwicklung objektorientierter Software 5. November / 12
48 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { } Formale Entwicklung objektorientierter Software 5. November / 12
49 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; tmp.i = 27; x = y; x.i = 27; } Formale Entwicklung objektorientierter Software 5. November / 12
50 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; //allowed (local variable) tmp.i = 27; x = y; x.i = 27; } Formale Entwicklung objektorientierter Software 5. November / 12
51 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; //allowed (local variable) tmp.i = 27; //allowed (in assignable clause) x = y; x.i = 27; } Formale Entwicklung objektorientierter Software 5. November / 12
52 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; //allowed (local variable) tmp.i = 27; //allowed (in assignable clause) x = y; //allowed (in assignable clause) x.i = 27; } Formale Entwicklung objektorientierter Software 5. November / 12
53 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; //allowed (local variable) tmp.i = 27; //allowed (in assignable clause) x = y; //allowed (in assignable clause) x.i = 27; //forbidden (not local, not in assignable) } Formale Entwicklung objektorientierter Software 5. November / 12
54 assignable expressions Comma-separated list of: e.f (where f a field) a[*], a[x..y] (where a an array expression) \nothing, \everything (default) Example C x, y; //@ assignable x, x.i; void m() { C tmp = x; //allowed (local variable) tmp.i = 27; //allowed (in assignable clause) x = y; //allowed (in assignable clause) x.i = 27; //forbidden (not local, not in assignable) } assignable clauses are always evaluated in the pre-state! Formale Entwicklung objektorientierter Software 5. November / 12
55 Other JML Features Java visibility modifiers, spec public modifier Formale Entwicklung objektorientierter Software 5. November / 12
56 Other JML Features Java visibility modifiers, spec public modifier pure modifier ( diverges false; + assignable \nothing; ) Formale Entwicklung objektorientierter Software 5. November / 12
57 Other JML Features Java visibility modifiers, spec public modifier pure modifier ( diverges false; + assignable \nothing; ) model methods, model fields Formale Entwicklung objektorientierter Software 5. November / 12
58 Other JML Features Java visibility modifiers, spec public modifier pure modifier ( diverges false; + assignable \nothing; ) model methods, model fields assertions //@ assert e; Formale Entwicklung objektorientierter Software 5. November / 12
59 Other JML Features Java visibility modifiers, spec public modifier pure modifier ( diverges false; + assignable \nothing; ) model methods, model fields assertions //@ assert e; specification inheritance Formale Entwicklung objektorientierter Software 5. November / 12
60 Other JML Features Java visibility modifiers, spec public modifier pure modifier ( diverges false; + assignable \nothing; ) model methods, model fields assertions //@ assert e; specification inheritance many more... Formale Entwicklung objektorientierter Software 5. November / 12
61 Nullity JML has modifiers non null and nullable Formale Entwicklung objektorientierter Software 5. November / 12
62 Nullity JML has modifiers non null and nullable private Object x; Formale Entwicklung objektorientierter Software 5. November / 12
63 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; Formale Entwicklung objektorientierter Software 5. November / 12
64 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; void Object p); Formale Entwicklung objektorientierter Software 5. November / 12
65 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; void Object p); implicit precondition added to all contracts: requires p!= null; Formale Entwicklung objektorientierter Software 5. November / 12
66 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; void Object p); implicit precondition added to all contracts: requires p!= null; Object m(); Formale Entwicklung objektorientierter Software 5. November / 12
67 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; void Object p); implicit precondition added to all contracts: requires p!= null; Object m(); implicit postcondition added to all contracts: ensures \result!= null; Formale Entwicklung objektorientierter Software 5. November / 12
68 Nullity JML has modifiers non null and nullable private Object x; implicit invariant added to class: invariant x!= null; void Object p); implicit precondition added to all contracts: requires p!= null; Object m(); implicit postcondition added to all contracts: ensures \result!= null; non null is the default! If something may be null, you have to declare it nullable explicitly. Formale Entwicklung objektorientierter Software 5. November / 12
69 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker Formale Entwicklung objektorientierter Software 5. November / 12
70 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) Formale Entwicklung objektorientierter Software 5. November / 12
71 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks Formale Entwicklung objektorientierter Software 5. November / 12
72 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) Formale Entwicklung objektorientierter Software 5. November / 12
73 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) ESC/Java2: leightweight static verification Formale Entwicklung objektorientierter Software 5. November / 12
74 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) ESC/Java2: leightweight static verification KeY: full static verification Formale Entwicklung objektorientierter Software 5. November / 12
75 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) ESC/Java2: leightweight static verification KeY: full static verification green: tools that you may find helpful for this course Formale Entwicklung objektorientierter Software 5. November / 12
76 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) ESC/Java2: leightweight static verification KeY: full static verification green: tools that you may find helpful for this course blue: tools explicitly used in this course Formale Entwicklung objektorientierter Software 5. November / 12
77 JML Tools Many tools support JML (see JML homepage). Among them: jml: JML syntax checker jmldoc: code documentation (like Javadoc) jmlc: compiles Java+JML into bytecode with assertion checks jmlunit: unit testing (like JUnit) ESC/Java2: leightweight static verification KeY: full static verification green: tools that you may find helpful for this course blue: tools explicitly used in this course The tools do not yet support the new features of Java 5! e.g.: no generics, no enums, no enhanced for-loops, no autoboxing Formale Entwicklung objektorientierter Software 5. November / 12
78 THE Formale Entwicklung objektorientierter Software 5. November / 12
79 THE END Formale Entwicklung objektorientierter Software 5. November / 12
Formal Specification and Verification
Formal Specification and Verification Formal Specification, Part III Bernhard Beckert Adaptation of slides by Wolfgang Ahrendt Chalmers University, Gothenburg, Sweden Formal Specification and Verification:
JML. Java Modeling Language
JML Java Modeling Language Overview About the JML Project DBC Design By Contract JML concepts, examples, syntax and capabilities Basics Exceptions Invariants Assertions Quantifiers Other keywords JML hiding
Java Modelling Language (JML) References
Java Modelling Language (JML) References G. T. Leavens and Y. Cheon. Design by Contract with JML, August 2005. L. Burdy, Y. Cheon, D. Cok, M. Ernst, J. Kiniry, G. T. Leavens, K. R. M. Leino, and E. Poll.
Formal Methods for Software Development
Formal Methods for Software Development Java Modeling Language, Part I Wolfgang Ahrendt 04 October 2018 FMSD: Java Modeling Language /GU 181004 1 / 36 Role of JML in the Course programming/modelling property/specification
Overview The Java Modeling Language (Part 1) Related Work
Overview The Java Modeling Language (Part 1) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
The Java Modeling Language JML
The Java Modeling Language JML Néstor Cataño ncatano@puj.edu.co Faculty of Engineering Pontificia Universidad Javeriana The Java Modelling Language JML p.1/47 Lecture Plan 1. An Introduction to JML 2.
Advances in Programming Languages
T O Y H Advances in Programming Languages APL4: JML The Java Modeling Language David Aspinall (slides originally by Ian Stark) School of Informatics The University of Edinburgh Thursday 21 January 2010
JML tool-supported specification for Java Erik Poll Radboud University Nijmegen
JML tool-supported specification for Java Erik Poll Radboud University Nijmegen Erik Poll - JML p.1/41 Overview The specification language JML Tools for JML, in particular runtime assertion checking using
Programming with Contracts. Juan Pablo Galeotti, Alessandra Gorla Saarland University, Germany
Programming with Contracts Juan Pablo Galeotti, Alessandra Gorla Saarland University, Germany Contract A (formal) agreement between Method M (callee) Callers of M Rights Responsabilities Rights Responsabilities
Formal Methods for Software Development
Formal Methods for Software Development Java Modeling Language, Part II Wolfgang Ahrendt 29 September 2017 FMSD: Java Modeling Language /GU 171029 1 / 62 JML Modifiers JML extends the JAVA modifiers by
The Java Modeling Language (Part 1)
The Java Modeling Language (Part 1) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
Java Modeling Language (JML)
CIS 771: Software Specifications Introduction to JML Java Modeling Language (JML) A behavioral interface specification language for Java supporting design-by-contract (DBC)... invented by Gary T. Leavens
The JML Tool. Faculty of Engineering Pontificia Universidad Javeriana. The JML Tool p.1/23
The JML Tool Néstor Cataño ncatano@puj.edu.co Faculty of Engineering Pontificia Universidad Javeriana The JML Tool p.1/23 Tools for JML 1. Parsing and type-checking 2. Checking assertions at runtime 3.
An introduction to formal specifications and JML. Invariant properties
An introduction to formal specifications and JML Invariant properties Yves Ledru Université Grenoble-1 Laboratoire d Informatique de Grenoble Yves.Ledru@imag.fr 2013 Page 1 Invariant properties Invariants
JML. Outline. Métodos Formais em Engenharia de Software. MI, Braga these slides were prepared by adopting/adapting teaching material
Métodos Formais em Engenharia de Software JML José Carlos Bacelar Almeida Departamento de Informática Universidade do Minho MI, Braga 2008 Outline Design by Contract and JML Design by Contract Java Modeling
Java Modelling Language (JML) References
Java Modelling Language (JML) References www.jmlspecs.org G. T. Leavens and Y. Cheon, Design by Contract with JML, August 2005. C. Marché, C. Paulin-Mohring, and X. Urbain, The Krakatoa Tool for Cerification
Advanced JML Erik Poll Radboud University Nijmegen
JML p.1/23 Advanced JML Erik Poll Radboud University Nijmegen JML p.2/23 Core JML Remember the core JML keywords were requires ensures signals invariant non null pure \old, \forall, \result JML p.3/23
Assertions & Design-by-Contract using JML Erik Poll University of Nijmegen
Assertions & Design-by-Contract using JML Erik Poll University of Nijmegen Erik Poll - JML p.1/39 Overview Assertions Design-by-Contract for Java using JML Contracts and Inheritance Tools for JML Demo
Advances in Programming Languages
Advances in Programming Languages Lecture 12: Practical Tools for Java Correctness Ian Stark School of Informatics The University of Edinburgh Friday 31 November 2014 Semester 1 Week 7 http://www.inf.ed.ac.uk/teaching/courses/apl
Testing, Debugging, and Verification
Testing, Debugging, and Verification Formal Specification, Part II Srinivas Pinisetty 23 November 2017 Introduction Today: Introduction to Dafny: An imperative language with integrated support for formal
The Java Modeling Language a Basis for Static and Dynamic Verification
The Java Modeling Language a Basis for Static and Dynamic Verification Wolfgang Ahrendt Chalmers University of Technology, Gothenburg, Sweden School on Runtime Verification Praz sur Arly 19 Mar. 2018 Java
Introduction to JML David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen
Introduction to JML David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2 & JML Tutorial p.1/30
Program Verification (6EC version only)
Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language
Testing Library Specifications by Verifying Conformance Tests
Testing Library Specifications by Verifying Conformance Tests Joseph R. Kiniry, Daniel M. Zimmerman, Ralph Hyland ITU Copenhagen, UW Tacoma, UCD Dublin 6th International Conference on Tests & Proofs Prague,
Rigorous Software Development CSCI-GA
Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 6 Disclaimer. These notes are derived from notes originally developed by Jochen Hoenicke. They are copyrighted
The Java Modeling Language (Part 2)
The Java Modeling Language (Part 2) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
JML Class Specifications The Java Modeling Language (Part 2) A Java Class
JML Class Specifications The Java Modeling Language (Part 2) Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria
Non-null References by Default in the Java Modeling Language
Non-null References by Default in the Java Modeling Language Patrice Chalin Dependable Software Research Group (DSRG) Computer Science and Software Engineering Department Concordia University Montreal,
Static program checking and verification
Chair of Software Engineering Software Engineering Prof. Dr. Bertrand Meyer March 2007 June 2007 Slides: Based on KSE06 With kind permission of Peter Müller Static program checking and verification Correctness
Formal Methods for Java
Formal Methods for Java Lecture 6: Introduction to JML Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg May 15, 2017 Jochen Hoenicke (Software Engineering) Formal Methods for Java
UC Santa Barbara. CS189A - Capstone. Christopher Kruegel Department of Computer Science UC Santa Barbara
CS189A - Capstone Christopher Kruegel Department of Computer Science http://www.cs.ucsb.edu/~chris/ Design by Contract Design by Contract and the language that implements the Design by Contract principles
Formal Specification and Verification
Formal Specification and Verification Proof Obligations Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
Advanced JML. and more tips and pitfalls. David Cok, Joe Kiniry, and Erik Poll
Advanced JML and more tips and pitfalls David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2
Formal Methods for Java
Formal Methods for Java Lecture 30: Conclusion Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg Feb 17, 2012 Jochen Hoenicke (Software Engineering) FM4J Feb 17, 2012 1 / 21 Topics
Introduction to the Java Modeling Language
Introduction to the Java Modeling Language Modular Specification and Verification for Java Gary T. Leavens 1 Curtis Clifton 2 Hridesh Rajan 3 Robby 4 1 School of Electrical Engineering and Computer Science,
Formal Methods for Java
Formal Methods for Java Lecture 1: Introduction Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg October 26, 2011 Jochen Hoenicke (Software Engineering) Formal Methods for Java October
Design by Contract with JML
Design by Contract with JML Gary T. Leavens and Yoonsik Cheon August 16, 2006 Abstract This document gives a tutorial introduction to the Java Modeling Language (JML), and explains how JML can be used
An Aspect-Oriented Approach. Henrique Rebêlo Informatics Center
An Aspect-Oriented Approach to implement JML Features Henrique Rebêlo Informatics Center Federal University of Pernambuco Summary jmlc problems bigger code, slower code, no suppport for Java ME, and bad
Advances in Programming Languages
O T Y H Advances in Programming Languages APL8: ESC/Java2 David Aspinall (including slides by Ian Stark and material adapted from ESC/Java2 tutorial by David Cok, Joe Kiniry and Erik Poll) School of Informatics
Checking Program Properties with ESC/Java
Checking Program Properties with ESC/Java 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich 1 ESC/Java A checker for Java programs Finds null pointers, array dereferences Checks Hoare logic
ESC/Java 2. Checker for Java 2. Extended. Static. B y K ats man Andrey S oftware E ngineering S em inar
ESC/Java 2 Extended Static Checker for Java 2 B y K ats man Andrey S oftware E ngineering S em inar 2 0 0 8 Background ESC/Java - Original development by Compaq Systems Research Center (1997) as a successor
Formal methods What are they? Uses Tools Application to software development
FormalMethods Page 1 Formal methods introduction 9:26 PM Formal methods What are they? Uses Tools Application to software development FormalMethods Page 2 What are formal methods? 9:49 PM Do you have any
Preliminary Design of JML:
Preliminary Design of JML: A Behavioral Interface Specification Language for Java by Gary T. Leavens, Albert L. Baker, and Clyde Ruby TR #98-06z June 1998, revised July, November 1998, January, April,
ESC/Java2 Warnings David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen
ESC/Java2 Warnings David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2 & JML Tutorial p.1/??
Assertions, pre/postconditions
Programming as a contract Assertions, pre/postconditions Assertions: Section 4.2 in Savitch (p. 239) Specifying what each method does q Specify it in a comment before method's header Precondition q What
Advances in Programming Languages
T O Y H Advances in Programming Languages APL14: Practical tools for Java Correctness David Aspinall (slides originally by Ian Stark) School of Informatics The University of Edinburgh Friday 12 November
JML What are model fields? Translation to JavaDL Demo. JML Model Fields. Christian Engel. ITI, Universität Karlsruhe. 08.
ITI, Universität Karlsruhe 08. Juni 2005 Outline JML 1 JML 2 3 4 JML JML...... is a specification language tailored to Java. JML JML...... is a specification language tailored to Java.... serves as an
Formal Methods for Java
Formal Methods for Java Lecture 5: JML and Abstract Data Types Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg November 9, 2011 Jochen Hoenicke (Software Engineering) Formal Methods
Preliminary Design of JML:
Preliminary Design of JML: A Behavioral Interface Specification Language for Java by Gary T. Leavens, Albert L. Baker, and Clyde Ruby TR #98-06t June 1998, revised July, November 1998, January, April,
Discussion of Design Alternatives for JML Java 5 Annotations
Discussion of Design Alternatives for JML Java 5 Annotations Kristina P. Boysen and Gary T. Leavens January 9, 2008 Abstract The Java Modeling Language (JML) is a specification language for Java that allows
Design by Contract and JML: concepts and tools
Métodos Formais em Engenharia de Software Design by Contract and JML: concepts and tools José Carlos Bacelar Almeida Departamento de Informática Universidade do Minho MI/MEI 2008/2009 1 Talk Outline Design
Canica: An IDE for the Java Modeling Language
Canica: An IDE for the Java Modeling Language Angelica B. Perez, Yoonsik Cheon, and Ann Q. Gates TR #06-36 August 2006 Keywords: Integrated development environment, specification tool, programming tool,
Testing, Debugging, Program Verification
Testing, Debugging, Program Verification Automated Test Case Generation, Part II Wolfgang Ahrendt & Vladimir Klebanov & Moa Johansson 12 December 2012 TDV: ATCG II /GU 2011-12-12 1 / 17 Recap Specification-/Model-Based
Property Specifications
Property Specifications Jim Browne Table of Contents Overview Temporal Logics Specification Patterns The major part of this lecture is taken from slides by David Garlan 9/4/2008 Unification of Verification
Specification and Verification of Garbage Collector by Java Modeling Language
Specification and Verification of Garbage Collector by Java Modeling Language Wenhui Sun, Yuting Sun, Zhifei Zhang Department of Computer Science and Technology Beijing Jiaotong University Beijing, China
JML s Rich, Inherited Specifications for Behavioral Subtypes
JML s Rich, Inherited Specifications for Behavioral Subtypes Gary T. Leavens TR #06-22 August 11, 2006 Keywords: Supertype abstraction, behavioral subtype, behavioral subtyping, modularity, specification
Java: advanced object-oriented features
Chair of Software Engineering Carlo A. Furia, Marco Piccioni, Bertrand Meyer Java: advanced object-oriented features Chair of Software Engineering Carlo A. Furia, Marco Piccioni, Bertrand Meyer Packages
Verifying Java Programs Verifying Java Programs with KeY
Verifying Java Programs Verifying Java Programs with KeY Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at
The JML and JUnit Way of Unit Testing and its Implementation
Computer Science Technical Reports Computer Science 2-2004 The JML and JUnit Way of Unit Testing and its Implementation Gary T. Leavens Iowa State University Yoonsik Cheon Iowa State University Follow
OOP Design by Contract. Carsten Schuermann Kasper Østerbye IT University Copenhagen
OOP Design by Contract Carsten Schuermann Kasper Østerbye IT University Copenhagen 1 Today's schedule Design by Contract why the term contract what design issue is captured, and why bother what is a pre-condition
ESC/Java2 extended static checking for Java Erik Poll Radboud University Nijmegen
ESC/Java2 extended static checking for Java Erik Poll Radboud University Nijmegen Erik Poll - JML p.1/19 Extended static checker for Java ESC/Java by Rustan Leino et.al. Extension ESC/Java2 by David Cok
Code Contracts. Pavel Parízek. CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics
Code Contracts http://d3s.mff.cuni.cz Pavel Parízek CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Pavel Parízek Code Contracts 2 Assertions Typically used as internal checks in the program
JML and ESC/Java2 Homework Exercises
This document contains a set of homework exercises for those that wish to learn JML and ESC/Java2. It was begun by Joseph R. Kiniry in May 2004 for the tutorial Design by Contract and
Announcements. Specifications. Outline. Specifications. HW1 is due Thursday at 1:59:59 pm
Announcements HW1 is due Thursday at 1:59:59 pm Specifications 2 Outline Specifications Benefits of specifications Specification conventions Javadoc JML PoS specifications Specifications A specification
How the Design of JML Accommodates Both Runtime Assertion Checking and Formal Verification
Computer Science Technical Reports Computer Science 3-2004 How the Design of JML Accommodates Both Runtime Assertion Checking and Formal Verification Gary T. Leavens Iowa State University Yoonsik Cheon
AP COMPUTER SCIENCE JAVA CONCEPTS IV: RESERVED WORDS
AP COMPUTER SCIENCE JAVA CONCEPTS IV: RESERVED WORDS PAUL L. BAILEY Abstract. This documents amalgamates various descriptions found on the internet, mostly from Oracle or Wikipedia. Very little of this
The Use of JML in Embedded Real-Time Systems
The Use of JML in Embedded Real-Time Systems Joseph Kiniry Technical University of Denmark JTRES 2012 24 October 2012 Acknowledgements Some content based on an OOPSLA tutorial by: Gary T. Leavens, Curtis
Specification tips and pitfalls
Specification tips and pitfalls David Cok, Joe Kiniry, and Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2 & JML
Accessible Formal Methods: A Study of the Java Modeling Language
Accessible Formal Methods: A Study of the Java Modeling Language A project presented to the Department of Computer and Information Sciences State University of New York Polytechnic Institute at Utica Utica,
Jive/JML Generating Proof Obligations From JML Specifications
Jive/JML Generating Proof Obligations From JML Specifications Ghislain Fourny gfourny@student.ethz.ch Swiss Federal Institute of Technology Zurich Software Component Technology Group Semester Project March
n Specifying what each method does q Specify it in a comment before method's header n Precondition q Caller obligation n Postcondition
Programming as a contract Assertions, pre/postconditions and invariants Assertions: Section 4.2 in Savitch (p. 239) Loop invariants: Section 4.5 in Rosen Specifying what each method does q Specify it in
Verifying Java Programs with KeY
Verifying Java Programs with KeY Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
An overview of JML tools and applications
Int J Softw Tools Technol Transfer (2004) / Digital Object Identifier (DOI) 10.1007/s10009-004-0167-4 An overview of JML tools and applications Lilian Burdy 1,YoonsikCheon 2,DavidR.Cok 3, Michael D. Ernst
Preliminary Design of JML:
Preliminary Design of JML: A Behavioral Interface Specification Language for Java by Gary T. Leavens, Albert L. Baker, and Clyde Ruby TR #98-06p June 1998, revised July, November 1998, January, April,
Object Ownership in Program Verification
Object Ownership in Program Verification Werner Dietl 1 and Peter Müller 2 1 University of Washington wmdietl@cs.washington.edu 2 ETH Zurich peter.mueller@inf.ethz.ch Abstract. Dealing with aliasing is
JML and Java 1.5+ David R. Cok Eastman Kodak Company, Research Laboratories 9 October 2008 SAVCBS08 workshop
JML and Java 1.5+ David R. Cok Eastman Kodak Company, Research Laboratories 9 October 2008 SAVCBS08 workshop Java 1.5 was a big step (in 2004) Tools built on or for Java had to make a considerable infrastructure
JML and Aspects: The Benefits of
JML and Aspects: The Benefits of Instrumenting JML Features with AspectJ Henrique Rebêlo Sérgio Soares Ricardo Lima Paulo Borba Márcio Cornélio Java Modeling Language Formal specification language for
5.5 Behavioral Subtyping
5.5 Behavioral Subtyping Subtyping of programming languages enforces that - no type errors occur, and - there is a method implementation for each method invocation. It does not guarantee that subtype objects
Preliminary Design of JML:
Preliminary Design of JML: A Behavioral Interface Specification Language for Java by Gary T. Leavens, Albert L. Baker, and Clyde Ruby TR #98-06o June 1998, revised July, November 1998, January, April,
Motivation. Correct and maintainable software Cost effective software production Implicit assumptions easily broken
Spec# Andreas Vida Motivation Correct and maintainable software Cost effective software production Implicit assumptions easily broken Need more formal f specification Integration into a popular language
A Practical Approach to Programming With Assertions
A Practical Approach to Programming With Assertions Ken Bell Christian-Albrechts Universität Kiel Department of Computer Science and Applied Mathematics Real-Time Systems and Embedded Systems Group July
Runtime Checking for Program Verification Systems
Runtime Checking for Program Verification Systems Karen Zee, Viktor Kuncak, and Martin Rinard MIT CSAIL Tuesday, March 13, 2007 Workshop on Runtime Verification 1 Background Jahob program verification
Software Engineering Testing and Debugging Testing
Software Engineering Testing and Debugging Testing Prof. Dr. Peter Thiemann Universitt Freiburg 08.06.2011 Recap Testing detect the presence of bugs by observing failures Debugging find the bug causing
TRIAL EXAM C Software Engineering using Formal Methods TDA293 / DIT270
TRIAL EXAM C Software Engineering using Formal Methods TDA293 / DIT270 also serving as additional training material for the course Formal Methods for Software Development, TDA294/DIT271 1 Exam/Tenta SEFM
An Assertion Checking Wrapper Design for Java
An Assertion Checking Wrapper Design for Java Roy Patrick Tan Department of Computer Science Virginia Tech 660 McBryde Hall, Mail Stop 0106 Blacksburg, VA 24061, USA rtan@vt.edu Stephen H. Edwards Department
Why Design by Contract! CS 619 Introduction to OO Design and Development. Design by Contract. Fall 2012
Why Design by Contract What s the difference with Testing? CS 619 Introduction to OO Design and Development Design by Contract Fall 2012 Testing tries to diagnose (and cure) defects after the facts. Design
Lecture 10 Design by Contract
CS 5959 Writing Solid Code Fall 2015 Nov-23 Lecture 10 Design by Contract Zvonimir Rakamarić University of Utah Design by Contract Also called assume-guarantee reasoning Developers annotate software components
Verifying JML specifications with model fields
Verifying JML specifications with model fields Cees-Bart Breunesse and Erik Poll Department of Computer Science, University of Nijmegen Abstract. The specification language JML (Java Modeling Language)
Formal Specification with the Java Modeling Language
Chapter 7 Formal Specification with the Java Modeling Language Marieke Huisman, Wolfgang Ahrendt, Daniel Grahl, and Martin Hentschel This text is a general, self contained, and tool independent introduction
Java Loose Ends. 11 December 2017 OSU CSE 1
Java Loose Ends 11 December 2017 OSU CSE 1 What Else? A few Java issues introduced earlier deserve a more in-depth treatment: Try-Catch and Exceptions Members (static vs. instance) Nested interfaces and
CSE331 Winter 2014, Midterm Examination February 12, 2014
CSE331 Winter 2014, Midterm Examination February 12, 2014 Please do not turn the page until 10:30. Rules: The exam is closed-book, closed-note, etc. Please stop promptly at 11:20. There are 100 points
Specification of a transacted memory for smart cards in Java and JML
Specification of a transacted memory for smart cards in Java and JML Erik Poll University of Nijmegen, NL Pieter Hartel Eduard de Jong Joint work with University of Twente Sun Microsystems Transacted Memory
Formal Systems II: Applications
Formal Systems II: Applications Functional Verification of Java Programs: Java Dynamic Logic Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
ESC/Java2 Use and Features David Cok, Joe Kiniry, Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen
ESC/Java2 Use and Features David Cok, Joe Kiniry, Erik Poll Eastman Kodak Company, University College Dublin, and Radboud University Nijmegen David Cok, Joe Kiniry & Erik Poll - ESC/Java2 & JML Tutorial
CS 161 Computer Security
Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions
A Run-time Assertion Checker for Java using JML
Computer Science Technical Reports Computer Science 5-1-2000 A Run-time Assertion Checker for Java using JML Abhay Bhorkar Follow this and additional works at: http://lib.dr.iastate.edu/cs_techreports
JML in Feature-Oriented Programming
JML in Feature-Oriented Programming Fabian Benduhn, Supervisor:Thomas Thüm March 23rd, 2012 University of Magdeburg, Germany Java Modeling Language (JML) Specification language for Java Specification as
Model-Driven Development of Reactive Information Systems
Software Tools for Technology Transfer manuscript No. (will be inserted by the editor) Model-Driven Development of Reactive Information Systems From Graph Transformation Rules to JML Contracts Reiko Heckel
ESC/Java extended static checking for Java Erik Poll, Joe Kiniry, David Cok University of Nijmegen; Eastman Kodak Company
ESC/Java extended static checking for Java Erik Poll, Joe Kiniry, David Cok University of Nijmegen; Eastman Kodak Company Erik Poll - JML p.1/?? ESC/Java Extended static checker by Rustan Leino et.al.
Verification Condition Generation
Verification Condition Generation Jorge Sousa Pinto Departamento de Informática / Universidade do Minho jsp@di.uminho.pt www.di.uminho.pt/~jsp Outline (1) - From Hoare Logic to VCGen algorithms: an architecture