Verifying Executable Object-Oriented Specifications with Separation Logic

  • Stephan van Staden
  • Cristiano Calcagno
  • Bertrand Meyer
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6183)


Specifications of Object-Oriented programs conventionally employ Boolean expressions of the programming language for assertions. Programming errors can be discovered by checking at runtime whether an assertion, such as a precondition or class invariant, holds. In this work, we show how separation logic can be used to verify that these executable specifications will always hold at runtime. Both the program and its executable assertions are verified with respect to separation logic specifications. A novel notion called relative purity embraces historically problematic side-effects in executable specifications, and verification boils down to proving connecting implications. Even model-based specifications can be verified. The framework is also well-suited to separation logic proof tools and now implemented in jStar. Numerous automatically verified examples illustrate the framework’s use and utility.


Object-orientation Specification Verification Separation logic Executable assertions Contracts 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    ECMA International: Standard ECMA-367. Eiffel: Analysis, Design and Programming Language. 2nd edn. (June 2006)Google Scholar
  2. 2.
    Barnett, M., Leino, K.R.M., Schulte, W.: The Spec# programming system: An overview. In: Barthe, G., Burdy, L., Huisman, M., Lanet, J.-L., Muntean, T. (eds.) CASSIS 2005. LNCS, vol. 3362, pp. 49–69. Springer, Heidelberg (2005)Google Scholar
  3. 3.
    Leavens, G.T., Baker, A.L., Ruby, C.: Preliminary design of JML: a behavioral interface specification language for Java. SIGSOFT Softw. Eng. Notes 31(3), 1–38 (2006)CrossRefGoogle Scholar
  4. 4.
    Van Staden, S., Calcagno, C.: Reasoning about multiple related abstractions with MultiStar. Technical Report 666, ETH Zurich (2010)Google Scholar
  5. 5.
    Parkinson, M.J., Bierman, G.M.: Separation logic, abstraction and inheritance. In: POPL 2008: Proceedings of the 35th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 75–86. ACM, New York (2008)CrossRefGoogle Scholar
  6. 6.
    Distefano, D., Parkinson, J., Matthew, J.: jStar: towards practical verification for Java. In: OOPSLA 2008: Proceedings of the 23rd ACM SIGPLAN conference on Object-oriented programming systems languages and applications, pp. 213–226. ACM, New York (2008)CrossRefGoogle Scholar
  7. 7.
    Jacobs, B., Smans, J., Piessens, F.: Verifying the composite pattern using separation logic. SAVCBS Composite pattern challenge track (2008)Google Scholar
  8. 8.
    Müller, P., Poetzsch-Heffter, A., Leavens, G.T.: Modular invariants for layered object structures. Science of Computer Programming 62(3), 253–286 (2006)zbMATHCrossRefMathSciNetGoogle Scholar
  9. 9.
    Cheon, Y., Leavens, G., Sitaraman, M., Edwards, S.: Model variables: cleanly supporting abstraction in design by contract: Research articles. Softw. Pract. Exper. 35(6), 583–599 (2005)CrossRefGoogle Scholar
  10. 10.
    Schoeller, B., Widmer, T., Meyer, B.: Making specifications complete through models. In: Reussner, R., Stafford, J.A., Szyperski, C. (eds.) Architecting Systems with Trustworthy Components. LNCS, vol. 3938, pp. 48–70. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  11. 11.
    O’Hearn, P.W., Reynolds, J.C., Yang, H.: Local reasoning about programs that alter data structures. In: Fribourg, L. (ed.) CSL 2001 and EACSL 2001. LNCS, vol. 2142, pp. 1–19. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  12. 12.
    Raza, M., Gardner, P.: Footprints in local reasoning. Logical Methods in Computer Science 5(2:4), 1–27 (2009)Google Scholar
  13. 13.
    Reynolds, J.C.: Separation logic: A logic for shared mutable data structures. In: LICS 2002: Proceedings of the 17th Annual IEEE Symposium on Logic in Computer Science, Washington, DC, USA, pp. 55–74. IEEE Computer Society, Los Alamitos (2002)CrossRefGoogle Scholar
  14. 14.
    Parkinson, M.J.: Local reasoning for Java. PhD thesis, University of Cambridge, Computer Laboratory. Technical Report UCAM-CL-TR-654 (November 2005)Google Scholar
  15. 15.
    Parkinson, M., Bierman, G.: Separation logic and abstraction. In: POPL 2005: Proceedings of the 32nd annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 247–258. ACM, New York (2005)Google Scholar
  16. 16.
    Summers, A.J., Drossopoulou, S., Müller, P.: The need for flexible object invariants. In: IWACO 2009: International Workshop on Aliasing, Confinement and Ownership in Object-Oriented Programming, pp. 1–9. ACM, New York (2009)CrossRefGoogle Scholar
  17. 17.
    Leino, K.R.M., Schulte, W.: A verifying compiler for a multi-threaded object-oriented language. Software System Reliability and Security 9, 351–416 (2007)Google Scholar
  18. 18.
    Leavens, G.T., Leino, K.R.M., Müller, P.: Specification and verification challenges for sequential object-oriented programs. Formal Aspects of Computing 19(2), 159–189 (2007)zbMATHCrossRefGoogle Scholar
  19. 19.
    Darvas, Á., Müller, P.: Faithful mapping of model classes to mathematical structures. IET Software 2(6), 477–499 (2008)CrossRefGoogle Scholar
  20. 20.
    Darvas, A., Müller, P.: Reasoning about method calls in interface specifications. Journal of Object Technology (JOT) 5(5), 59–85 (2006)Google Scholar
  21. 21.
    Naumann, D.A.: Observational purity and encapsulation. Theor. Comput. Sci. 376(3), 205–224 (2007)zbMATHCrossRefMathSciNetGoogle Scholar
  22. 22.
    Burdy, L., Cheon, Y., Cok, D.R., Ernst, M.D., Kiniry, J.R., Leavens, G.T., Leino, K.R.M., Poll, E.: An overview of JML tools and applications. International Journal on Software Tools for Technology Transfer (STTT) 7(3), 212–232 (2005)Google Scholar
  23. 23.
    Brotherston, J., Bornat, R., Calcagno, C.: Cyclic proofs of program termination in separation logic. In: POPL 2008: Proceedings of the 35th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 101–112. ACM, New York (2008)CrossRefGoogle Scholar
  24. 24.
    Van Staden, S.: jStar sources of the examples,
  25. 25.
    Leino, K.R.M., Müller, P.: Verification of equivalent-results methods. In: Drossopoulou, S. (ed.) ESOP 2008. LNCS, vol. 4960, pp. 307–321. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  26. 26.
    Chin, W.N., David, C., Nguyen, H.H., Qin, S.: Enhancing modular OO verification with separation logic. In: POPL 2008: Proceedings of the 35th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 87–99. ACM, New York (2008)CrossRefGoogle Scholar
  27. 27.
    Cheon, Y., Leavens, G.T.: A runtime assertion checker for the Java modeling language (JML). In: Proceedings of the international conference on Software engineering research and practice (SERP 2002), Las Vegas, pp. 322–328. CSREA Press (2002)Google Scholar
  28. 28.
    Meyer, B., Ciupa, I., Leitner, A., Liu, L.L.: Automatic testing of object-oriented software. In: van Leeuwen, J., Italiano, G.F., van der Hoek, W., Meinel, C., Sack, H., Plášil, F. (eds.) SOFSEM 2007. LNCS, vol. 4362, pp. 114–129. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  29. 29.
    Ciupa, I., Leitner, A., Oriol, M., Meyer, B.: Experimental assessment of random testing for object-oriented software. In: ISSTA 2007: Proceedings of the 2007 international symposium on Software testing and analysis, pp. 84–94. ACM, New York (2007)CrossRefGoogle Scholar
  30. 30.
    Calcagno, C., Distefano, D., O’Hearn, P.W., Yang, H.: Compositional shape analysis by means of bi-abduction. In: POPL 2009: Proceedings of the 36th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 289–300. ACM, New York (2009)Google Scholar
  31. 31.
    Gulavani, B.S., Chakraborty, S., Ramalingam, G., Nori, A.V.: Bottom-up shape analysis. In: Palsberg, J., Su, Z. (eds.) SAS 2009. LNCS, vol. 5673, pp. 188–204. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  32. 32.
    Clarke, D., Drossopoulou, S., Müller, P., Noble, J., Wrigstad, T.: Aliasing, confinement, and ownership in object-oriented programming (IWACO). In: Eugster, P. (ed.) ECOOP 2008 Workshops. LNCS, vol. 5475, pp. 30–41. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  33. 33.
    Salcianu, A., Rinard, M.C.: Purity and side effect analysis for Java programs. In: Cousot, R. (ed.) VMCAI 2005. LNCS, vol. 3385, pp. 199–215. Springer, Heidelberg (2005)Google Scholar
  34. 34.
    Darvas, A., Leino, K.R.M.: Practical reasoning about invocations and implementations of pure methods. In: Dwyer, M.B., Lopes, A. (eds.) FASE 2007. LNCS, vol. 4422, pp. 336–351. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  35. 35.
    Rudich, A., Darvas, Á., Müller, P.: Checking well-formedness of pure-method specifications. In: Cuellar, J., Maibaum, T., Sere, K. (eds.) FM 2008. LNCS, vol. 5014, pp. 68–83. Springer, Heidelberg (2008)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Stephan van Staden
    • 1
  • Cristiano Calcagno
    • 2
    • 3
  • Bertrand Meyer
    • 1
  1. 1.ETH ZurichSwitzerland
  2. 2.Monoidics Ltd 
  3. 3.Imperial CollegeLondon

Personalised recommendations