A Language Framework for Expressing Checkable Properties of Dynamic Software

  • James C. Corbett
  • Matthew B. Dwyer
  • John Hatcliff
  • Robby
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 1885)


Research on how to reason about correctness properties of software systems using model checking is advancing rapidly. Work on extracting finite-state models from program source code and on abstracting those models is focused on enabling the tractable checking of program properties such as freedom from deadlock and assertion violations. For the most part, the problem of specifying more general program properties has not been considered.

In this paper, we report on the support for specifying properties of dynamic multi-threaded Java programs that we have built into the Bandera system. Bandera extracts finite-state models, in the input format of several existing model checkers, from Java code based on the property to be checked. The Bandera Specification Language (BSL) provides a language for defining general assertions and pre/post conditions on methods. It also supports the definition of observations that can be made of the state of program objects and the incorporation of those observations as predicates that can be instantiated in the scope of object quantifiers and used in describing common forms of state/event sequencing properties. We describe BSL and illustrate it on an example analyzed with Bandera and the Spin model checker.


Model Check Temporal Logic Object Constraint Language Java Program Temporal Formula 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bal, T., Rajamani, S.K.: Boolean programs: A model and process for software analysis. Technical Report 2000-14, Microsoft Research (2000)Google Scholar
  2. 2.
    Browne, I.A., Manna, Z., Sipma, H.B.: FSTTCS 1995. LNCS, vol. 1026. Springer, Heidelberg (1995)Google Scholar
  3. 3.
    Cimatti, A., Clarke, E., Giunchiglia, F., Roveri, M.: NuSMV: a new symbolic model checker. International Journal on Software Tools for Technology Transfer (2000) (to appear)Google Scholar
  4. 4.
    Corbett, J.C., Dwyer, M.B., Hatcliff, J., Laubach, S., Păsăreanu, C.S., Robby, Zheng, H.: Bandera: Extracting finite-state models from Java source code. In: Proceedings of the 22nd International Conference on Software Engineering (June 2000)Google Scholar
  5. 5.
    Corbett, J.C., Dwyer, M.B., Hatcliff, J., Robby: Bandera: A source-level interface for model checking Java programs. In: Proceedings of the 22nd International Conference on Software Engineering (June 2000)Google Scholar
  6. 6.
    Darimont, R., van Lamsweerde, A.: Formal refinement patterns for goal-driven requirements elaboration. In: Proceedings of the Fourth ACM SIGSOFT Symposium on Foundations of Software Engineering, October 1996, pp. 179–190 (1996)Google Scholar
  7. 7.
    Demartini, C., Iosif, R., Sisto, R.: A deadlock detection tool for concurrent Java programs. Software - Practice and Experience 29(7), 577–603 (1999)CrossRefGoogle Scholar
  8. 8.
    Demartini, C., Iosif, R., Sisto, R.: dspin: A dynamic extension of SPIN. In: Dams, D.R., Gerth, R., Leue, S., Massink, M. (eds.) SPIN 1999. LNCS, vol. 1680, p. 261. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  9. 9.
    Dillon, L.K., Kutty, G., Moser, L.E., Melliar-Smith, P.M., Ra- makrishna, Y.S.: A graphical interval logic for specifying concurrent systems. ACM Transactions on Software Engineering and Methodology 3(2), 131–165 (1994)CrossRefGoogle Scholar
  10. 10.
    Dwyer, M.B., Avrunin, G.S., Corbett, J.C.: Property specification patterns for finite-state verification. In: Ardis, M. (ed.) Proceedings of the Second Workshop on Formal Methods in Software Practice, March 1998, pp. 7–15 (1998)Google Scholar
  11. 11.
    Dwyer, M.B., Pasareanu, C.S., Corbett, J.C.: Translating Ada programs for model checking: A tutorial. Technical Report 98-12, Kansas State University, Department of Computing and Information Sciences (1998)Google Scholar
  12. 12.
    Dwyer, M.B., Avrunin, G.S., Corbett, J.C.: A System of Specification Patterns (1998),
  13. 13.
    Dwyer, M.B., Avrunin, G.S., Corbett, J.C.: Patterns in property specifications for finite-state verification. In: Proceedings of the 21st International Conference on Software Engineering (May 1999)Google Scholar
  14. 14.
    Grove, D.P.: Effective Interprocedural Optimization of Object-oriented Lan- guages. PhD thesis, University of Washington (1998)Google Scholar
  15. 15.
    Hatcliff, J., Corbett, J.C., Dwyer, M.B., Sokolowski, S., Zheng, H.: A formal study of slicing for multi-threaded programs with JVM concurrency primitives. In: Cortesi, A., Filé, G. (eds.) SAS 1999. LNCS, vol. 1694, p. 1. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  16. 16.
    Havelund, K., Pressburger, T.: Model checking Java programs using Java PathFinder. International Journal on Software Tools for Technology Transfer (1999)Google Scholar
  17. 17.
    Holzmann, G.J.: The model checker SPIN. IEEE Transactions on Software Engineering 23(5), 279–294 (1997)CrossRefMathSciNetGoogle Scholar
  18. 18.
    Holzmann, G.J., Smith, M.H.: Software model checking: Extracting verification models from source code. In: Proceedings of FORTE/PSTV 1999 (November 1999)Google Scholar
  19. 19.
    Iosif, R., Sisto, R.: On the specification and semantics of source level properties in java. In: Proceedings of the First International Workshop on Automated Program Analysis Testing and Verification (June 2000), Held in conjunction with the 2000 Internation Conference on Software EngineeringGoogle Scholar
  20. 20.
    Jackson, D.: Alloy: A lightweight object modelling notationGoogle Scholar
  21. 21.
    Kramer, R.: iContract|the Java Design by Contract tool. In: Proceedings of Technology of Object-Oriented Languages and Systems, TOOLS-USA. IEEE Press, Los Alamitos (1998)Google Scholar
  22. 22.
    Leavens, G.T., Baker, A.L., Ruby, C.: JML: a Java modeling lan- guage. In: Reflection and Software Engineering (1998)Google Scholar
  23. 23.
    Manna, Z., Pnueli, A.: The Temporal Logic of Reactive and Concurrent Systems: Specification. Springer, Heidelberg (1991)zbMATHGoogle Scholar
  24. 24.
    Warmer, J., Kleppe, A.: The Object Constraint Language: Precise Mode- ling with UML. Addison-Wesley, Reading (1998)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2000

Authors and Affiliations

  • James C. Corbett
    • 1
  • Matthew B. Dwyer
    • 2
  • John Hatcliff
    • 2
  • Robby
    • 2
  1. 1.University of HawaiiHonoluluUSA
  2. 2.SAnToS LaboratoryKansas State UniversityManhattanUSA

Personalised recommendations