Formal Methods for Java
Recently, formal methods have been successfully used to specify and verify large software system. A current example is the Verisoft project, whose goal is to create a fully verified processor, operating system and compiler. In this lecture we will investigate the existing methods for the language Java. The language Java was chosen because it is a mature language, with a semi-formal definition of its semantics (The Java Language Specification). However, to use mathematical reasoning, we need a precise definition of the semantics. Therefore, we will sketch the definition of an operational semantics for Java. Furthermore, we will investigate different formal methods for Java. The starting point will be the language extension JML that allows Design by Contract. This allows to add pre- and postconditions to methods and invariants to classes and loops. These assertions can be checked during runtime and this is the purpose of the JML runtime assertion checker (jmlrac). On the other hand, there are static methods, e.g., ESC/Java and Jahob, that automatically provide mathematical proofs that the Java code ensures the post-condition for each possible pre-condition. If these proofs cannot be found automatically, one can also use theorem provers that assist in finding a proof manually. In this lecture, we will present the different approaches for verification of Java code. In the exercise you will investigate different tools on small practical examples.
| Course type | Lecture |
|---|---|
| Instructors | Jochen Hoenicke1 |
| Lecture |
Wednesday, 16:00–18:00 c.t., in building 106 room 00 007 (MMR) Friday, 10:00-11:00 c.t., in building 106 room 00 007 (MMR) |
| Exercise | Friday, 11:00–12:00, in building 106 room 00 007 (MMR) |
| First session | Lecture 26.10.11 |
| Language of instruction | English |
| Credits | 6 |
| Exams | Oral, Time and Place 14./15.03.2012 |
| Course Catalog | Formale Methoden für Java2 |
News
- Solutions to the exercise sheets might be handed in at the beginning of lecture on Wednesday
Formalia
Admission criteria
You have to do all exercises.
Exercise Submission Scheme
Every Wednesday before the lecture.
Exam
There will be oral exams. The exam will take place on 14th or 15th of March.
Please register via examination office as usual.Resources
Literature
- J. Gosling et al.: The Java Language Specification3 (third edition)
- T. Lindholm, F. Yellin: The Java Virtual Machine Specification4 (second edition)
- Home page of the JML Project5.G. Leavens et al.. JML Reference Manual6 (DRAFT), February 2007.
- B. Beckert, R. Hähnle, P. Schmitt (Eds.): Verification of Object-Oriented Software: The KeY Approach7, Springer-Verlag, LNCS 4334
- M. Barnet, D. Naumann: Friends Need A Bit More: Maintaining Invariants Over Shared State8, February 2004
- Home page of Jahob9
- V. Kuncak: Modular Data Structure Verification10
- Home page of JPF11
Slides
- Lecture 112 (Wednesday, 26.10.2011)
- Lecture 213 (Friday, 28.10.2011)
- Lecture 314 (Wednesday, 02.11.2011)
- Lecture 415 (Friday, 04.11.2011)
- Lecture 516 (Wednesday, 09.11.2011)
- Common classes for examples: PriorityQueue.java17, Test.java18
- Priority Queue example with model variable: Heap.java19
- Priority Queue example with ghost variable: Heap.java20
- Lecture 621 (Friday, 11.11.2011)
- Lecture 722 (Wednesday, 16.11.2011)
- Lecture 823 (Friday, 18.11.2011)
- Lecture 924 (Wednesday, 23.11.2011)
- Lecture 1025 (Friday, 25.11.2011)
- Lecture 1126 (Wednesday, 30.11.2011)
- KeY examples:
- andcommute.key27
- hilbert1.key28, hilbert2.key29, hilbert3.key30, hilbert4.key31, hilbert5.key32
- quant1.key33, quant2.key34, quant3.key35
- eqsymm.key36, eqtrans.key37
- Lecture 1238 (Friday, 02.12.2011)
- Lecture 1339 (Wednesday, 07.12.2011)
- Examples: execution.key40, while.key41, gcd.java42
- Lecture 1443 (Friday, 09.12.2011)
- Lecture 1544 (Wednesday, 14.12.2011)
- Examples: Mul.java45, Search.java46, BubbleSort.java47
- Lecture 1648 (Friday, 16.12.2011)
- Lecture 1749 (Wednesday, 21.12.2011)
- Example: SimpleMap.java50
- Lecture 1851 (Friday, 23.12.2011)
- Example: McCarthy.java52, McCarthy.java.proof53 (corresponding KeY proof)
- Lecture 1954 (Wednesday, 11.01.2012)
- Lecture 2055 (Friday, 13.01.2012)
- Lecture 2156 (Wednesday, 18.01.2012)
- Lecture 2257 (Friday, 20.01.2012)
- Lecture 2358 (Wednesday, 25.01.2012)
- Lecture 2459 (Friday, 27.01.2012)
- Lecture 2560 (Wednesday, 01.02.2012)
- Lecture 2661 (Friday, 03.02.2012)
- Lecture 2762 (Wednesday, 08.02.2012)
- Lecture 2863 (Friday, 10.02.2012)
- Examples: Common Classes: PriorityQueue.java64, Heap.java65
- Example: Test.java66
- Example: TestPF.java67, TestPF.jpf68
- Example: TestBitSet.java69, TestSet.jpf70
- Example: TestBitBucket.java71, BitBucket,java72, TestBucket.jpf73
- Lecture 2974 (Wednesday, 15.02.2012)
- Lecture 3075 (Friday, 17.02.2012)
Exercises
- Exercise Sheet 076 (no submission - discussed on Friday, 28.10.2011)
- Exercise Sheet 177 (submission: 02.11.2011)
- Exercise Sheet 278 (submission: 09.11.2011)
- Exercise Sheet 379 (submission: 16.11.2011) Additional Material: Map.java80, Key.java81, IntKey.java82
- Exercise Sheet 483 (submission: 23.11.2011) Additional Material: InsertionSort.java84
- Exercise Sheet 585 (submission: 30.11.2011) Additional Material: Heap.java86, HeapElem.java87, IntHeapElem.java88
- Exercise Sheet 689 (submission: 07.12.2011)
- Exercise Sheet 790 (submission: 14.12.2011)
- Exercise Sheet 891 (submission: 21.12.2011) Additional Material: InsertionSort.java92
- Christmas Sheet93 (no submission - just exam preparation) Additional Material: christmas.tar.bz294
- Exercise Sheet 995 (submission: 18.01.2012)
- Exercise Sheet 1096 (submission: 25.01.2012)
- Exercise Sheet 1197 (submission: 01.02.2012)
- Exercise Sheet 1298 (submission: 08.02.2012) Additional Material: NonNullChecker.java99, NonNull.java100
- Exercise Sheet 13101 (submission: 15.02.2012) Additional Material: MyStack.java102, MyStack.jpf103
