Motivat vation and Acknowledgements on and Acknowledgements - PDF document

Motivat vation and Acknowledgements on and Acknowledgements Software M So ftware Mode odel Check Checking Us ng Using Bogor ng Bogor – a Mod Modular an r and E Extensible Model Model Che Checking ng F Frame amework All other model-checkers that we know of support only simple � predicates on system states (e.g., the primitive propositions occurring in temporal logic formulas). 3rd Estonian Summer School in Especially when modeling OO languages, states themselves can be � Computer and System Science (ESSCaSS'04) quite complicated (they include the heap). Therefore we are interested in supporting specification predicates � Slide Set 07: Checking JML Specifications over Bogor states that are significantly stronger than those supported in other model-checking frameworks. http://bogor.projects.cis.ksu.edu � Moreover, we are interested in supporting, as much as possible, rich specification languages that other verification tools using http://www.cis.ksu.edu/~hatcliff/ESSCaSS04 different technologies (e.g., theorem proving) also support. These slides are taken from our talk given at TACAS 2004 on � “Checking Strong Specifications Using an Extensible Model- John Hatcliff Matthew B. Dwyer Robby Checking Framework” SAnToS Laboratory, Kansas State University, USA A significant portion of this work was carried out by Edwin � Support Rodriguez US Army Research Office (ARO) Boeing Lockheed Martin US National Science Foundation (NSF) Honeywell Technology Center NASA Langley US Department of Defense IBM Rockwell-Collins ATC Advanced Research Projects Agency (DARPA) Intel Sun Microsystems Concu Concurren rrent Q Queue ueue ba based sed o on Lin Linked ed Li List st Asser Assertions fo for So r Softwa ftware Ve e Veri rifi fica cati tion on (Doug L (Doug Lea’ ea’s u s util.con concurren rrent package package) public class LinkedNode { protected synchronized Object extract() { public Object value; synchronized (head) { � Assertions have become a common practice public LinkedNode next; Object x = null; LinkedNode first = head.next; among developers public LinkedNode(Object x) { if (first != null) { value = x; x = first.value; protected void insert(Object x) { } first.value = null; � 10 years ago assertions were not considered } synchronized (putLock) { assert(x != null); head = first; } useful by developers public class LinkedQueue { LinkedNode p = new LinkedNode(x); return x; } protected final Object putLock; synchronized (last) { } protected LinkedNode head; � recent evidence of the effectiveness of protected LinkedNode last = head; last.next = p; protected int waitingForTake = 0; protected void insert(Object x) { assertions last = p; synchronized (putLock) { public LinkedQueue() { LinkedNode p = new LinkedNode(x); } putLock = new Object(); � David Rosenblum (1995) synchronized (last) { head = new LinkedNode(null); last.next = p; if (waitingForTake > 0) putLock.notify(); } last = p; � now some programming languages have return; } public boolean isEmpty() { if (waitingForTake > 0) putLock.notify(); included assertions in their standard synchronized (head) { } return; return head.next == null; } } } } specifications } public Object take() { � c.f. Java 1.4 assertions public void put(Object x) { Object x = extract(); if (x == null) if (x != null) return x; throw new IllegalArgumentException(); else … insert(x); } } … allows concurrent access to put() and take() … allows concurrent access to put() and take() An exam example ple An exam example ple public class LinkedNode { protected synchronized Object extract() { public class LinkedNode { protected synchronized Object extract() { public Object value; public Object value; assert(putLock != null); synchronized (head) { synchronized (head) { public LinkedNode next; public LinkedNode next; Object x = null; Object x = null; LinkedNode first = head.next; LinkedNode first = head.next; public LinkedNode(Object x) { public LinkedNode(Object x) { if (first != null) { if (first != null) { value = x; x = first.value; value = x; x = first.value; public class LinkedQueue { } first.value = null; } first.value = null; } head = first; } protected final Object putLock; head = first; } public class LinkedQueue { } return x; protected LinkedNode head; protected final Object putLock; return x; } public class LinkedQueue { protected LinkedNode head; Specify that putLock is never null assert(putLock != null); Specify that putLock is never null } protected final Object putLock; protected LinkedNode last = head; protected LinkedNode last = head; } } protected LinkedNode head; protected int waitingForTake = 0; Need more declarative formalisms Need more declarative formalisms protected LinkedNode last = head; protected int waitingForTake = 0; public LinkedQueue() { protected void insert(Object x) { protected int waitingForTake = 0; . protected void insert(Object x) { assert(putLock != null); assert(putLock != null); putLock = new Object(); synchronized (putLock) { synchronized (putLock) { public LinkedQueue() { LinkedNode p = new LinkedNode(x); . head = new LinkedNode(null); LinkedNode p = new LinkedNode(x); putLock = new Object(); assert(putLock != null); synchronized (last) { synchronized (last) { last.next = p; head = new LinkedNode(null); . } last.next = p; last = p; } last = p; } public boolean isEmpty() { if (waitingForTake > 0) putLock.notify(); } assert(putLock != null); return; public boolean isEmpty() { if (waitingForTake > 0) putLock.notify(); synchronized (head) { } synchronized (head) { return head.next == null; return; assert(putLock != null); return head.next == null; } } } assert(putLock != null); } } } public Object take() { } assert(putLock != null); public Object take() { public void put(Object x) { Object x = extract(); public void put(Object x) { Object x = extract(); assert(putLock != null); if (x != null) return x; if (x == null) if (x == null) if (x != null) return x; else … throw new IllegalArgumentException(); assert(putLock != null); throw new IllegalArgumentException(); else … insert(x); } insert(x); } assert(putLock != null); } } Specify that putLock is never null Specify that putLock is never null 1