Deductive Verification of Object-Oriented Software Part A Bernhard - - PowerPoint PPT Presentation

▶
deductive verification of object oriented software
SMART_READER_LITE
LIVE PREVIEW

Deductive Verification of Object-Oriented Software Part A Bernhard - - PowerPoint PPT Presentation

Feb 26, 2023 219 likes •1.29k views

Deductive Verification of Object-Oriented Software Part A Bernhard Beckert | VTSA, 24.28.08.2015 KIT I NSTITUTE FOR T HEORETICAL C OMPUTER S CIENCE www.kit.edu KIT University of the State of Baden-Wuerttemberg and National Laboratory

slide-1
SLIDE 1

www.kit.edu

KIT – University of the State of Baden-Wuerttemberg and National Laboratory of the Helmholtz Association

Bernhard Beckert | VTSA, 24.–28.08.2015 Part A

Deductive Verification of Object-Oriented Software

KIT – INSTITUTE FOR THEORETICAL COMPUTER SCIENCE

slide-2
SLIDE 2

Part I The KeY System – An Overview

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 2/102

slide-3
SLIDE 3

Part I The KeY System – An Overview

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 3/102

slide-4
SLIDE 4

KeY Project

www.key-project.org

Project Consortium

Bernhard Beckert and Peter H. Schmitt, Karlsruhe Institute of Technology Reiner H¨ ahnle TU Darmstadt Wolfgang Ahrendt Chalmers Univ., Gothenburg

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-5
SLIDE 5

KeY Project

www.key-project.org

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-6
SLIDE 6

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-7
SLIDE 7

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-8
SLIDE 8

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-9
SLIDE 9

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-10
SLIDE 10

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-11
SLIDE 11

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 4/102

slide-12
SLIDE 12

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-13
SLIDE 13

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-14
SLIDE 14

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-15
SLIDE 15

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-16
SLIDE 16

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-17
SLIDE 17

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-18
SLIDE 18

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-19
SLIDE 19

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-20
SLIDE 20

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-21
SLIDE 21

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-22
SLIDE 22

Specific Features of the KeY Approach

Part II: The Java Modeling Language

Program-level specification and annotation

Part III: Program Verification with Dynamic Logic

Program logic, explicit JAVA in the logic, not translated away Forward symbolic execution instead of backwards wp generation

Part IV: Verifying Information Flow Properties

JML extended with information-flow concepts Non-interference expressed in Dynamic Logic

Not covered in this tutorial

Additional benefits: test case generation, symbolic debugging.

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 5/102

slide-23
SLIDE 23

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-24
SLIDE 24

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-25
SLIDE 25

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-26
SLIDE 26

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-27
SLIDE 27

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-28
SLIDE 28

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-29
SLIDE 29

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-30
SLIDE 30

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-31
SLIDE 31

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-32
SLIDE 32

Workflow

successful or failed proof attempt first-order proof obligations KeY problem file KeY verification browser annotated JAVA program fully automatic translation automatic translation triggered by user rule-based symbolic execution using KeY KeY + SMT solvers KeY rule base JML* Dynamic Logic FOL Taclet Language

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 6/102

slide-33
SLIDE 33

KeY Verification Process

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 7/102

slide-34
SLIDE 34

Example: JML Specification of ♠❛①✭✮

/*@ requires a != null @ ensures (\ forall int i; 0<=i && i<a.length ; @ \result >= a[i]); @ ensures a.length > 0 ==> @ (\ exists int i; 0<=i && i<a.length ; @ \result == a[i]); @*/ ♣✉❜❧✐❝ st❛t✐❝ ✐♥t max(✐♥t[] a) { ✐❢ ( a.length == 0 ) r❡t✉r♥ 0; ✐♥t max = a[0], i = 1; /*@ loop_invariant @ i <= a.length && @ (\ forall int j; j>=0 && j<i; max >=a[j]) && @ (\ exists int j; j>=0 && j<i; max==a[j]); @ modifies i, max; @ decreases a.length - i; @*/ ✇❤✐❧❡ ( i < a.length ) { ✐❢ ( a[i] > max ) max = a[i]; ++i; } r❡t✉r♥ max; }

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 8/102

slide-35
SLIDE 35

DEMO

The KeY Tool

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 9/102

slide-36
SLIDE 36

A Case Study: The TimSort Bug

[De Gouw et al., CAV 2015]

TimSort

Standard algorithm: Open JDK, Android, Apache, Haskell, Python Clever combination of merge sort and insertion sort

Bug found during (failed) verification attempt with KeY

Throws uncaught ArrayIndexOutOfBoundsException for certain inputs Symbolic counter example generation & analysis lead to witness Interaction (understanding intermediate proof state) crucial

Verification of fixed version with KeY

Proof: JDK code with bug fix does not throw an exception 2,200,000 rule applications – 99.8 % automatic

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 10/102

slide-37
SLIDE 37

A Case Study: The TimSort Bug

[De Gouw et al., CAV 2015]

TimSort

Standard algorithm: Open JDK, Android, Apache, Haskell, Python Clever combination of merge sort and insertion sort

Bug found during (failed) verification attempt with KeY

Throws uncaught ArrayIndexOutOfBoundsException for certain inputs Symbolic counter example generation & analysis lead to witness Interaction (understanding intermediate proof state) crucial

Verification of fixed version with KeY

Proof: JDK code with bug fix does not throw an exception 2,200,000 rule applications – 99.8 % automatic

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 10/102

slide-38
SLIDE 38

A Case Study: The TimSort Bug

[De Gouw et al., CAV 2015]

TimSort

Standard algorithm: Open JDK, Android, Apache, Haskell, Python Clever combination of merge sort and insertion sort

Bug found during (failed) verification attempt with KeY

Throws uncaught ArrayIndexOutOfBoundsException for certain inputs Symbolic counter example generation & analysis lead to witness Interaction (understanding intermediate proof state) crucial

Verification of fixed version with KeY

Proof: JDK code with bug fix does not throw an exception 2,200,000 rule applications – 99.8 % automatic

Overview Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 10/102

slide-39
SLIDE 39

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 11/102

slide-40
SLIDE 40

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 12/102

slide-41
SLIDE 41

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-42
SLIDE 42

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

JML annotation occur as special comments in source programm

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-43
SLIDE 43

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

precondition

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-44
SLIDE 44

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

postcondition

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-45
SLIDE 45

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

JML operator \old(e) refers to value of e in prestate

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-46
SLIDE 46

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

All side-effect-free Java expressions allowed

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-47
SLIDE 47

Method Contracts

JML Spec of Postincrement ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires true; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

Plus special operators (\ . . .)

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 13/102

slide-48
SLIDE 48

Method Contracts

Non-null default ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc /*@ nullable @*/ act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires act != ♥✉❧❧; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 14/102

slide-49
SLIDE 49

Method Contracts

Non-null default ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc /*@ nullable @*/ act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires act != ♥✉❧❧; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

By default JML assumes all fields and parameters to be non null

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 14/102

slide-50
SLIDE 50

Method Contracts

Non-null default ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc /*@ nullable @*/ act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires act != ♥✉❧❧; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

The default is overwritten by the keyword nullable

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 14/102

slide-51
SLIDE 51

Method Contracts

Non-null default ♣✉❜❧✐❝ ❝❧❛ss PostInc{ ♣✉❜❧✐❝ PostInc /*@ nullable @*/ act; ♣✉❜❧✐❝ ✐♥t x,y; /*@ ♣✉❜❧✐❝ normal_behavior @ requires act != ♥✉❧❧; @ ensures act.x == \old(act.y) && @ act.y == \old(act.y) + 1; @*/ ♣✉❜❧✐❝ ✈♦✐❞ postinc() { act.x = act.y++; }}

In this case the precondition has to be adapted accordingly

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 14/102

slide-52
SLIDE 52

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } }

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-53
SLIDE 53

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } } JML uses \result to refer to the return value of a method

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-54
SLIDE 54

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } } Method commonEntry looks for an index within the bounds

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-55
SLIDE 55

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } } such that the two arrays have the same entry

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-56
SLIDE 56

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } } If no such index exists the return value is the upper bound

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-57
SLIDE 57

Method Contracts

Specification of commonEntry

❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0<=l && l<r && r<=a1.length && r<=a2.length; @ assignable \nothing; @ ensures ( l <= \result && \result < r && @ a1[\result] == a2[\result] ) || \result == r ; @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j]); @*/ ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r) { ... } } Furthermore, \result should be the first index of this kind

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 15/102

slide-58
SLIDE 58

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 16/102

slide-59
SLIDE 59

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 17/102

slide-60
SLIDE 60

Quantifiers in JML

Specification of commonEntry @ ... @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j] ); @ ...

Quantified formulas in JML consist of the quantifier the range restriction the body

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 18/102

slide-61
SLIDE 61

Quantifiers in JML

Specification of commonEntry @ ... @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j] ); @ ...

Quantified formulas in JML consist of the quantifier the range restriction the body

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 18/102

slide-62
SLIDE 62

Quantifiers in JML

Specification of commonEntry @ ... @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j] ); @ ...

Quantified formulas in JML consist of the quantifier the range restriction the body

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 18/102

slide-63
SLIDE 63

Quantifiers in JML

Specification of commonEntry @ ... @ ensures (\forall int j; l <= j && j < \result; @ a1[j] != a2[j] ); @ ...

Quantified formulas in JML consist of the quantifier the range restriction the body

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 18/102

slide-64
SLIDE 64

Quantifiers in JML

Semantics

JML

\forall T x; R; B;

predicate logic

∀ T :x (R → B)

JML

\exists T x; R; B;

predicate logic

∃ T :x (R ∧ B)

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 19/102

slide-65
SLIDE 65

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 20/102

slide-66
SLIDE 66

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 21/102

slide-67
SLIDE 67

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-68
SLIDE 68

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop invariant

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-69
SLIDE 69

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop invariant is valid before entering the loop since

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-70
SLIDE 70

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} } l <= k && k <= r

follows from

k==l

and precondition

l<r

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-71
SLIDE 71

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} } l <= k && k <= r

follows from

k==l

and precondition

l<r

and quantification is empty

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-72
SLIDE 72

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

If the loop body is started in a state satisfying the invariant, it terminates in a state satisfying the invariant

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-73
SLIDE 73

Loop Invariants

Loop Invariant for commonEntry ❝❧❛ss SITAPar{ ♣✉❜❧✐❝ ✐♥t[] a1,a2; ... ♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall int i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

Distinguish break and non-break case!

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 22/102

slide-74
SLIDE 74

Using a Loop Invariant

On termination of the loop the invariant

l <= k && k <= r && (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i])

plus

\result = k

plus reason for termination of the loop

k == r

  • r

k < r && a1[k] == a2[k]

imply the postconditions

(l <= \result && \result < r && a1[\result] == a2[\result]) || \result == r

and

\forall ✐♥t j; l <= j && j < \result; a1[j] != a2[j]

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 23/102

slide-75
SLIDE 75

Using a Loop Invariant

On termination of the loop the invariant

l <= k && k <= r && (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i])

plus

\result = k

plus reason for termination of the loop

k == r

  • r

k < r && a1[k] == a2[k]

imply the postconditions

(l <= \result && \result < r && a1[\result] == a2[\result]) || \result == r

and

\forall ✐♥t j; l <= j && j < \result; a1[j] != a2[j]

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 23/102

slide-76
SLIDE 76

Loop Termination

♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

is ≥ 0 on entering the loop strictly decreases in every loop iteration but always stays ≥ 0

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 24/102

slide-77
SLIDE 77

Loop Termination

♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop variant is ≥ 0 on entering the loop strictly decreases in every loop iteration but always stays ≥ 0

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 24/102

slide-78
SLIDE 78

Loop Termination

♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop variant is ≥ 0 on entering the loop strictly decreases in every loop iteration but always stays ≥ 0

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 24/102

slide-79
SLIDE 79

Loop Termination

♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop variant is ≥ 0 on entering the loop strictly decreases in every loop iteration but always stays ≥ 0

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 24/102

slide-80
SLIDE 80

Loop Termination

♣✉❜❧✐❝ ✐♥t commonEntry(✐♥t l, ✐♥t r){ ✐♥t k = l; /*@ loop_invariant l <= k && k <= r && @ (\forall ✐♥t i; l <= i && i < k; a1[i] != a2[i] ); @ assignable \nothing; @ decreases a1.length - k; @*/ ✇❤✐❧❡(k < r){ ✐❢(a1[k] == a2[k]){❜r❡❛❦;} k++;} r❡t✉r♥ k;} }

The loop variant is ≥ 0 on entering the loop strictly decreases in every loop iteration but always stays ≥ 0

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 24/102

slide-81
SLIDE 81

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 25/102

slide-82
SLIDE 82

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 26/102

slide-83
SLIDE 83

Assignable Clauses

/*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0 <= pos1 && 0 <= pos2 && @ pos1 < a.length && pos2 < a.length; @ ensures a[pos1] == \old(a[pos2]) && @ a[pos2] == \old(a[pos1]); @ assignable a[pos1], a[pos2]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ swap(✐♥t[] a, ✐♥t pos1, ✐♥t pos2) { ✐♥t temp; temp = a[pos1]; a[pos1] = a[pos2]; a[pos2] = temp;}

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 27/102

slide-84
SLIDE 84

Assignable Clauses

/*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0 <= pos1 && 0 <= pos2 && @ pos1 < a.length && pos2 < a.length; @ ensures a[pos1] == \old(a[pos2]) && @ a[pos2] == \old(a[pos1]); @ assignable a[pos1], a[pos2]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ swap(✐♥t[] a, ✐♥t pos1, ✐♥t pos2) { ✐♥t temp; temp = a[pos1]; a[pos1] = a[pos2]; a[pos2] = temp;}

At most the locations in the assignable clause may be changed

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 27/102

slide-85
SLIDE 85

Assignable Clauses

/*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0 <= pos1 && 0 <= pos2 && @ pos1 < a.length && pos2 < a.length; @ ensures a[pos1] == \old(a[pos2]) && @ a[pos2] == \old(a[pos1]); @ assignable a[pos1], a[pos2]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ swap(✐♥t[] a, ✐♥t pos1, ✐♥t pos2) { ✐♥t temp; temp = a[pos1]; a[pos1] = a[pos2]; a[pos2] = temp;}

Everything else must remain unchanged

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 27/102

slide-86
SLIDE 86

Assignable Clauses

/*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0 <= pos1 && 0 <= pos2 && @ pos1 < a.length && pos2 < a.length; @ ensures a[pos1] == \old(a[pos2]) && @ a[pos2] == \old(a[pos1]); @ assignable a[pos1], a[pos2]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ swap(✐♥t[] a, ✐♥t pos1, ✐♥t pos2) { ✐♥t temp; temp = a[pos1]; a[pos1] = a[pos2]; a[pos2] = temp;}

Local variables need not be included

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 27/102

slide-87
SLIDE 87

Assignable Clauses

/*@ ♣✉❜❧✐❝ normal_behaviour @ requires 0 <= pos1 && 0 <= pos2 && @ pos1 < a.length && pos2 < a.length; @ ensures a[pos1] == \old(a[pos2]) && @ a[pos2] == \old(a[pos1]); @ assignable a[pos1], a[pos2]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ swap(✐♥t[] a, ✐♥t pos1, ✐♥t pos2) { ✐♥t temp; temp = a[pos1]; a[pos1] = a[pos2]; a[pos2] = temp;}

Assignable clauses are evaluated in the prestate

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 27/102

slide-88
SLIDE 88

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 28/102

slide-89
SLIDE 89

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 29/102

slide-90
SLIDE 90

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-91
SLIDE 91

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Method rearrange

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-92
SLIDE 92

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Method rearrange uses methods commonEntry

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-93
SLIDE 93

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Method rearrange uses methods commonEntry and swap

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-94
SLIDE 94

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Verification of rearrange uses their contracts, not their implementation

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-95
SLIDE 95

Using Contracts

❝❧❛ss SITA3{ ♣✉❜❧✐❝ ✐♥t[] a1, a2; /*@ ♣✉❜❧✐❝ normal_behaviour @ requires a1.length == a2.length; @ ensures (\forall ✐♥t i; 0<= i && i < a1.length; @ a1[i] == a2[i] ==> @ (\forall ✐♥t j; 0<= j && j < i; a1[j] == a2[j])); @ assignable a1[*],a2[*]; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ✐♥t m = 0 ; ✐♥t k = 0; ✇❤✐❧❡ (m < a1.length) { m = commonEntry(m,a1.length); ✐❢ (m < a1.length) {swap(a1,m,k); ✐❢ (a1 != a2) { swap(a2,m,k);} k = k+1 ; m = m+1;}}}}

Key to scalability

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 30/102

slide-96
SLIDE 96

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 31/102

slide-97
SLIDE 97

Part II The Java Modeling Language – By Example –

1

Method Contracts

2

Quantifiers

3

Handling Loops

4

Frame Conditions

5

Using Contracts

6

Abstraction

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 32/102

slide-98
SLIDE 98

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... }

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-99
SLIDE 99

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... }

model fields are only for specification

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-100
SLIDE 100

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... } \seq is an abstract data type

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-101
SLIDE 101

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... } represents clauses fix the semantics of model fields

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-102
SLIDE 102

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... } array2seq(a) yields the abstract sequence associated with array a

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-103
SLIDE 103

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... }

Only additional postcondition shown here

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-104
SLIDE 104

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... } seqPerm(s1,s2) is a predicate in the data type \seq,

true if s1 is a permutation of s2

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-105
SLIDE 105

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... }

The \dl prefix is a technical detail necessary since \seq is not (yet) part

  • f official JML

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102

slide-106
SLIDE 106

Model Fields

/*@ model \seq seq1; model \seq seq2; @*/ /*@ represents seq1 = \dl_array2seq(a1); @ represents seq2 = \dl_array2seq(a2); @*/ /*@ public normal_behaviour @ ensures \dl_seqPerm(seq1,\old(seq1)) && @ \dl_seqPerm(seq2,\old(seq2)) ; @*/ ♣✉❜❧✐❝ ✈♦✐❞ rearrange(){ ... }

Model fields allow abstraction and information hiding. They can be defined and used in interfaces.

Method Contracts Quantifiers Handling Loops Frame Conditions Using Contracts Abstraction Bernhard Beckert – Deductive Verification of Object-Oriented Software VTSA, 24.–28.08.2015 33/102