A New Invariant Rule for the Analysis of Loops with Non-standard Control Flows

  • Dominic SteinhöfelEmail author
  • Nathan Wasser
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10510)


Invariants are a standard concept for reasoning about unbounded loops since Floyd-Hoare logic in the late 1960s. For real-world languages like Java, loop invariant rules tend to become extremely complex. The main reason is non-standard control flow induced by return, throw, break, and continue statements, possibly combined and nested inside inner loops and try blocks. We propose the concept of a loop scope which gives rise to a new approach for the design of invariant rules. This permits “sandboxed” deduction-based symbolic execution of loop bodies which in turn allows a modular analysis even of complex loops. Based on the new concept we designed a loop invariant rule for Java that has full language coverage and implemented it in the program verification system KeY. Its main advantages are (1) much increased comprehensibility, which made it considerably easier to argue for its soundness, (2) simpler and easier to understand proof obligations, (3) a substantially decreased number of symbolic execution steps and sizes of resulting proofs in a representative set of experiments. We also show that the new rule, in combination with fully automatic symbolic state merging, realizes even greater proof size reduction and helps to address the state explosion problem of symbolic execution.


Loop Invariant Rule Loop Scope Symbolic Execution (SE) SE Steps State Merging Techniques 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Ahrendt, W., Beckert, B. (eds.): Deductive Software Verification - The KeY Book. LNCS, vol. 10001. Springer, Cham (2016). doi: 10.1007/978-3-319-49812-6 Google Scholar
  2. 2.
    Barnett, M., Chang, B.-Y.E., DeLine, R., Jacobs, B., Leino, K.R.M.: Boogie: a modular reusable verifier for object-oriented programs. In: Boer, F.S., Bonsangue, M.M., Graf, S., Roever, W.-P. (eds.) FMCO 2005. LNCS, vol. 4111, pp. 364–387. Springer, Heidelberg (2006). doi: 10.1007/11804192_17 CrossRefGoogle Scholar
  3. 3.
    Bobot, F., Filliâtre, J.C., et al.: Why3: Shepherd your herd of provers. In: Boogie 2011: First International Workshop on IVL, pp. 53–64 (2011)Google Scholar
  4. 4.
    Cadar, C., Dunbar, D., et al.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: 8th USENIX Conference on OSDI, pp. 209–224. USENIX Association, Berkeley (2008)Google Scholar
  5. 5.
    Cadar, C., Sen, K.: Symbolic execution for software testing: three decades later. Commun. ACM 56(2), 82–90 (2013)CrossRefGoogle Scholar
  6. 6.
    Cok, D.R.: OpenJML: software verification for Java 7 using JML, OpenJDK, and Eclipse. In: Proceedings of the 1st Workshop on FIDE, pp. 79–92 (2014)Google Scholar
  7. 7.
    Cuoq, P., Kirchner, F., Kosmatov, N., Prevosto, V., Signoles, J., Yakobowski, B.: Frama-C. In: Eleftherakis, G., Hinchey, M., Holcombe, M. (eds.) SEFM 2012. LNCS, vol. 7504, pp. 233–247. Springer, Heidelberg (2012). doi: 10.1007/978-3-642-33826-7_16 CrossRefGoogle Scholar
  8. 8.
    Dannenberg, R., Ernst, G.: Formal program verification using symbolic execution. IEEE Trans. Softw. Eng. SE–8(1), 43–52 (1982)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Filliâtre, J.C.: Deductive software verification. Int. J. Softw. Tools Technol. Transf. (STTT) 13(5), 397–403 (2011)CrossRefGoogle Scholar
  10. 10.
    Flanagan, C., Saxe, J.B.: Avoiding exponential explosion: generating compact verification conditions. SIGPLAN Not. 36(3), 193–205 (2001)CrossRefzbMATHGoogle Scholar
  11. 11.
    Gouw, S., Rot, J., Boer, F.S., Bubel, R., Hähnle, R.: OpenJDK’s Java.utils.Collection.sort() is broken: the good, the bad and the worst case. In: Kroening, D., Păsăreanu, C.S. (eds.) CAV 2015. LNCS, vol. 9206, pp. 273–289. Springer, Cham (2015). doi: 10.1007/978-3-319-21690-4_16 CrossRefGoogle Scholar
  12. 12.
    Hentschel, M., Hähnle, R., Bubel, R.: Visualizing unbounded symbolic execution. In: Seidl, M., Tillmann, N. (eds.) TAP 2014. LNCS, vol. 8570, pp. 82–98. Springer, Cham (2014). doi: 10.1007/978-3-319-09099-3_7 Google Scholar
  13. 13.
    Hoare, C.A.R.: An axiomatic basis for computer programming. Commun. ACM 12(10), 576–580 (1969)CrossRefzbMATHGoogle Scholar
  14. 14.
    Jaffar, J., Murali, V., et al.: Boosting concolic testing via interpolation. In: Proceedings of 9th Joint Meeting on FSE, pp. 48–58. USA. ACM, New York (2013)Google Scholar
  15. 15.
    Marché, C., Paulin-Mohring, C., et al.: The KRAKATOA tool for certification of JAVA/JAVACARD programs annotated in JML. J. Logic Algebr. Program. 58(1–2), 89–106 (2004)CrossRefzbMATHGoogle Scholar
  16. 16.
    Pariente, D., Ledinot, E.: Formal verification of industrial C code using Frama-C: a case study. In: Proceedings of the 1st International Conference on FoVeOOS, p. 205 (2010)Google Scholar
  17. 17.
    Păsăreanu, C.S., Visser, W.: Verification of Java programs using symbolic execution and invariant generation. In: Graf, S., Mounier, L. (eds.) SPIN 2004. LNCS, vol. 2989, pp. 164–181. Springer, Heidelberg (2004). doi: 10.1007/978-3-540-24732-6_13 CrossRefGoogle Scholar
  18. 18.
    Scheurer, D., Hähnle, R., Bubel, R.: A general lattice model for merging symbolic execution branches. In: Ogata, K., Lawford, M., Liu, S. (eds.) ICFEM 2016. LNCS, vol. 10009, pp. 57–73. Springer, Cham (2016). doi: 10.1007/978-3-319-47846-3_5 CrossRefGoogle Scholar
  19. 19.
    Steinhöfel, D., Wasser, N.: A new invariant rule for the analysis of loops with non-standard control flows. Technical report, TU Darmstadt (2017).
  20. 20.
    Stenzel, K.: Verification of Java card programs. Ph.D. thesis, University of Augsburg, Germany (2005)Google Scholar
  21. 21.
    Vogels, F., Jacobs, B., et al.: Featherweight VeriFast. LMCS 11(3), 1–57 (2015)MathSciNetzbMATHGoogle Scholar
  22. 22.
    Wasser, N.: Automatic generation of specifications using verification tools. Ph.D. thesis, Technische Universität Darmstadt, Darmstadt, January 2016Google Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  1. 1.Department of Computer ScienceTU DarmstadtDarmstadtGermany

Personalised recommendations