Verification of Object-Oriented Programs with Invariants.

Abstract

An object invariant defines what it means for an object's data to be in a consistent state. Object invariants are central to the design and correctness of objectoriented programs. This paper defines a programming methodology for using object invariants. The methodology, which enriches a program's state space to express when each object invariant holds, deals with owned object components, ownership transfer, and subclassing, and is expressive enough to allow many interesting object-oriented programs to be specified and verified. Lending itself to sound modular verification, the methodology also provides a solution to the problem of determining what state a method is allowed to modify.

Efficient Object Querying for Java

“…Class invariants are often captured using universal/existential quantifiers over object extents (e.g. [3,30,34,35]). Queries provide a natural approach to checking these invariants.…”

Observational Purity and Encapsulation

“…Equivalence then serves as basis for a suitable notion of simulation with which we justify observationally pure expressions in specifications. Our formulation is compatible with extant encapsulation systems for specific object-oriented languages, such as Ownership Types (Clarke et al, 2001;Clarke and Drossopoulou, 2002) and assertion-based ownership (Barnett et al, 2004a).…”

“…There has been considerable work refining and extending ownership encapsulation to encompass a wide variety of design patterns in object oriented programs (Müller, 2002;Clarke and Drossopoulou, 2002;Boyapati et al, 2003;Barnett et al, 2004a;Naumann and Barnett, 2006). Much of this work focuses on object invariants but, for the most part, what works for invariants works for simulations as demonstrated by Banerjee and Naumann (2005a,c).…”

“…So what we consider is a ternary relation, written and read "couples", on two heaps and a bijection -or what amounts to the same thing, a family, indexed by bijections, of binary relations β on heaps. If the cache involved other objects, an encapsulation condition would be imposed on them as well, e.g., via ownership (Clarke et al, 2001;Clarke and Drossopoulou, 2002;Barnett et al, 2004a). That prevents problems like Example 4.1.…”

Types for Hierarchic Shapes

“…In [6] a methodology for program specification and verification is proposed, whereby an object's invariants may depend on (possibly indirectly) owned objects. The state space of programs is enriched to express whether an object's validity holds (i.e., whether its invariant holds); there is support for explicitly altering an object validity, and explicit ownership transfer.…”