A Specification Language for Static and Runtime Verification of Data and Control Properties

Abstract

Abstract. Static verification techniques can verify properties across all executions of a program, but powerful judgements are hard to achieve automatically. In contrast, runtime verification enjoys full automation, but cannot judge future and alternative runs. In this paper we present a novel approach in which data-centric and control-oriented properties may be stated in a single formalism, amenable to both static and dynamic verification techniques. We develop and formalise a specification notation, ppDATE, extending the control-flow property language used in the runtime verification tool Larva with pre/post-conditions and show how specifications written in this notation can be analysed both using the deductive theorem prover KeY and the runtime verification tool Larva. Verification is performed in two steps: KeY first partially proves the data-oriented part of the specification, simplifying the specification which is then passed on to Larva to check at runtime for the remaining parts of the specification including the control-centric aspects. We apply the approach to Mondex, an electronic purse application.

A Model-Based Approach to Combining Static and Dynamic Verification Techniques

“…In the pseudo-rule above, we abuse notation and use a family of static-analysis pseudo-axioms SA(P , π) which asserts that by using a static analysis technique to check whether program P satisfies property π, we manage to automatically prove the entailment of the proof rule 1 . Similarly, we use the pseudo-axiom RV to indicate that the entailment will be verified at runtime.…”

Compliance Checking in the Open Payments Ecosystem

“…2. We envisage adopting techniques from recent work combining these two forms of verification [1,2,8,4]. One of the major challenges is the diverse nature of compliance it attempts to address.…”

StaRVOOrS : A Tool for Combined Static and Runtime Verification of Java

“…A detailed motivation for the combination along these two dimensions (data-vs. control-oriented, and static vs. dynamic verification) has been reported in [3,4] and will not be repeated here. For this paper, we only emphasise that this combination allows us to get a richer specification language able to express both data-and control-oriented properties, proving some properties once and for all statically, letting others to be checked at runtime.…”

“…The tool is a fully automated implementation of the theoretical results presented in [3,4]. Given a property specification and the original program, our tool chain produces a statically optimised monitor and the weaved program to be monitored.…”