Checking Well-Formedness of Pure-Method Specifications

Abstract

Abstract. Contract languages such as JML and Spec# specify invariants and pre-and postconditions using side-effect free expressions of the programming language, in particular, pure methods. For such contracts to be meaningful, they must be well-formed: First, they must respect the partiality of operations, for instance, the preconditions of pure methods used in the contract. Second, they must enable a consistent encoding of pure methods in a program logic, which requires that their specifications are satisfiable and that recursive specifications are well-founded. This paper presents a technique to check well-formedness of contracts. We give proof obligations that are sufficient to guarantee the existence of a model for the specification of pure methods. We improve over earlier work by providing a systematic solution including a soundness result and by supporting more forms of recursive specifications. Our technique has been implemented in the Spec# programming system.

Automatic verification of Java programs with dynamic frames

“…The pure method can call itself if its measure decreases. Ensuring consistency of the encoding of pure methods is an active area of research [LM09,RADM08].…”

“…More liberal schemes for ensuring consistency can be found in the literature (e.g. [DL07,RADM08]). The well-typedness criterion is used to ensure the program does not get stuck due to Field-and MethodNotFound errors.…”

Verifying Executable Object-Oriented Specifications with Separation Logic

“…They encode pure methods and their contracts in first-order logic as uninterpreted functions and axioms respectively [20,17,34]. Checking wellformedness of pure method specifications is vital in this step, because inconsistent axiomatizations can result from unsatisfiable specifications or recursive specifications which are ill-founded [35]. A pure method call in an assertion is encoded as an application of the corresponding uninterpreted function.…”

Efficient Well-Definedness Checking

“…Our implementation extends the Spec# verification tool [5] by a new module that performs well-definedness and well-foundedness checks on specifications using the Y procedure. Details of the technique applied in the well-formedness checker are described in [26]. Additionally, in order to be able to compare the different procedures, we have built a prototype that implements the D, L, and Y procedures for the syntax given in Figure 1.…”

“…We have implemented the new procedure in the Spec# verification tool [5] in the context of the well-formedness checking of method specifications [26]. We have compared our procedure with D and L using two automated theorem provers.…”