Abstract
Verification of a dynamically dispatched method call, E.m(), seems to depend on E’s dynamic type. To avoid case analysis and allow incremental development, object-oriented program verification uses supertype abstraction. In other words, one reasons about E.m() using m’s specification for E’s static type. Supertype abstraction is valid when each subtype in the program is a behavioral subtype. This article semantically formalizes supertype abstraction and behavioral subtyping for a Java-like sequential language with mutation and proves that behavioral subtyping is both necessary and sufficient for the validity of supertype abstraction. Specification inheritance, as in JML, is also formalized and proved to entail behavioral subtyping.
- Suad Alagic and Svetlana Kouznetsova. 2002. Behavioral compatibility of self-typed theories. In ECOOP 2002—Object-Oriented Programming. Lecture Notes in Computer Science, Vol. 2374. Springer, 585--608. Google Scholar
Digital Library
- Pierre America. 1987. Inheritance and subtyping in a parallel object-oriented language. In ECOOP’87 European Conference on Object-Oriented Programming. Lecture Notes in Computer Science, Vol. 276. Springer, 234--242. Google Scholar
Digital Library
- Pierre America. 1991. Designing an object-oriented programming language with behavioural subtyping. In Foundations of Object-Oriented Languages. Lecture Notes in Computer Science, Vol. 489. Springer, 60--90. Google Scholar
Digital Library
- Pierre America and Frank de Boer. 1990. Proving total correctness of recursive procedures. Information and Computation 84, 2, 129--164. Google Scholar
Digital Library
- Krzysztof R. Apt. 1981. Ten years of Hoare’s logic: A survey—part I. ACM Transactions on Programming Languages and Systems 3, 4, 431--483. Google Scholar
Digital Library
- Krzysztof R. Apt and Gordon D. Plotkin. 1986. Countable nondeterminism and random assignment. Journal of the ACM 33, 4, 724--767. Google Scholar
Digital Library
- Krzysztof R. Apt, Frank S. de Boer, and Ernst-Rüdiger Olderog. 2009. Verification of Sequential and Concurrent Programs (3rd ed.). Springer. Google Scholar
Digital Library
- Krzysztof R. Apt, Frank S. de Boer, Ernst-Rüdiger Olderog, and Stijn de Gouw. 2012. Verification of object-oriented programs: A transformational approach. Journal of Computer and System Sciences 78, 3, 823--852. Google Scholar
Digital Library
- Ralph-Johan Back. 1988. A calculus of refinements for program derivations. Acta Informatica 25, 593--624. Google Scholar
Digital Library
- Ralph-Johan Back and Joakim von Wright. 1998. Refinement Calculus: A Systematic Introduction. Springer-Verlag. Google Scholar
Cross Ref
- Anindya Banerjee, Nevin Heintze, and Jon G. Riecke. 2001. Design and correctness of program transformations based on control-flow analysis. In Theoretical Aspects of Computer Science. Lecture Notes in Computer Science, Vol. 2215. Springer, 420--447. Google Scholar
Digital Library
- Anindya Banerjee and David A. Naumann. 2005. Ownership confinement ensures representation independence for object-oriented programs. Journal of the ACM 52, 6, 894--960. Google Scholar
Digital Library
- Anindya Banerjee and David A. Naumann. 2013. Local reasoning for global invariants, part II: Dynamic boundaries. Journal of the ACM 60, 3, Article No. 19. Google Scholar
Digital Library
- Mike Barnett, Robert DeLine, Manuel Fähndrich, K. Rustan M. Leino, and Wolfram Schulte. 2004. Verification of object-oriented programs with invariants. Journal of Object Technology 3, 6, 27--56.Google Scholar
Cross Ref
- Mike Barnett, Robert DeLine, Bart Jacobs, Manuel Fähndrich, K. Rustan M. Leino, Wolfram Schulte, and Herman Venter. 2005a. The Spec# programming system: Challenges and directions. In Verified Software: Theories, Tools, Experiments. Lecture Notes in Computer Science, Vol. 4171. Springer, 144--152.Google Scholar
- Mike Barnett, K. Rustan M. Leino, and Wolfram Schulte. 2005b. The Spec# programming system: An overview. In Construction and Analysis of Safe, Secure, and Interoperable Smart Devices. Lecture Notes in Computer Science, Vol. 3362. Springer, 49--69. Google Scholar
Digital Library
- Bernhard Beckert, Reiner Hähnle, and Peter H. Schmitt. 2007. Verification of Object-Oriented Software. The KeY Approach. Lecture Notes in Artificial Intelligence, Vol. 4334. Springer-Verlag, Berlin. Google Scholar
Digital Library
- Bodil Biering, Lars Birkedal, and Noah Torp-Smith. 2005. BI hyperdoctrines and higher-order separation logic. In Programming Languages and Systems. Lecture Notes in Computer Science, Vol. 3444. Springer, 233--247. Google Scholar
Digital Library
- Gavin Bierman and Matthew Parkinson. 2005. Separation logic and abstraction. In Proceedings of the ACM Symposium on Principles of Programming Languages (POPL’05). 247--258. http://dx.doi.org/10.1145/1047659.1040326 Google Scholar
Digital Library
- Paulo Borba, Augusto Sampaio, Ana Cavalcanti, and Márcio Cornélio. 2004. Algebraic reasoning for object-oriented programming. Science of Computer Programming 52, 1--3, 53--100. Google Scholar
Digital Library
- Kim B. Bruce and Peter Wegner. 1986. An algebraic model of subtypes in object-oriented languages (Draft). ACM SIGPLAN Notices 21, 10, 163--172. Google Scholar
Digital Library
- Luca Cardelli. 1988. A semantics of multiple inheritance. Information and Computation 76, 2--3, 138--164. Google Scholar
Digital Library
- Yonghao Chen and Betty H. C. Cheng. 2000. A semantic foundation for specification matching. In Foundations of Component-Based Systems, G. T. Leavens and M. Sitaraman (Eds.). Cambridge University Press, New York, NY, 91--109. Google Scholar
Digital Library
- Yoonsik Cheon, Gary T. Leavens, Murali Sitaraman, and Stephen Edwards. 2005. Model variables: Cleanly supporting abstraction in design by contract. Software—Practice and Experience 35, 6, 583--599. Google Scholar
Digital Library
- Wei-Ngan Chin, Cristina David, Huu Hai Nguyen, and Shengchao Qin. 2008. Enhancing modular OO verification with separation logic. In Proceedings of the ACM Symposium on Principles of Programming Languages (POPL’08). ACM, New York, NY, 87--99. Google Scholar
Digital Library
- Willem-Paul de Roever and Kai Engelhardt. 1998. Data Refinement: Model-Oriented Proof Methods and Their Comparison. Cambridge University Press. Google Scholar
Cross Ref
- Krishna Kishore Dhara and Gary T. Leavens. 1996. Forcing behavioral subtyping through specification inheritance. In Proceedings of the 18th International Conference on Software Engineering. IEEE, Los Alamitos, CA, 258--267. Google Scholar
Digital Library
- Edsger W. Dijkstra. 1976. A Discipline of Programming. Prentice Hall. Google Scholar
Digital Library
- Johan Dovland, Einar Broch Johnsen, Olaf Owe, and Martin Steffen. 2008. Lazy behavioral subtyping. In FM 2008: Formal Methods. Lecture Notes in Computer Science, Vol. 5014. Springer, 52--67. DOI:http://dx.doi.org/10.1007/978-3-540-68237-0_6 Google Scholar
Digital Library
- Johan Dovland, Einar Broch Johnsen, Olaf Owe, and Martin Steffen. 2010. Lazy behavioral subtyping. Journal of Logic and Algebraic Programming 79, 7, 578--607. DOI:http://dx.doi.org/10.1016/j.jlap.2010.07.008Google Scholar
Cross Ref
- Johan Dovland, Einar Broch Johnsen, Olaf Owe, and Martin Steffen. 2011. Incremental reasoning with lazy behavioral subtyping for multiple inheritance. Science of Computer Programming 76, 10, 915--941. DOI:http://dx.doi.org/10.1016/j.scico.2010.09.006 Google Scholar
Digital Library
- ECMA International. 2006. Eiffel: Analysis, Design, and Programming Language (2nd ed.). ECMA International, Rue du Rhone 114, CH-1204, Geneva. Available at http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-367.pdf.Google Scholar
- Ivana Filipovic, Peter W. O’Hearn, Noam Rinetzky, and Hongseok Yang. 2010. Abstraction for concurrent objects. Theoretical Computer Science 411, 51--52, 4379--4398. Google Scholar
Digital Library
- Robert Bruce Findler and Matthias Felleisen. 2001. Contract soundness for object-oriented languages. In Proceedings of the 2001 Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA’01). 1--15. Google Scholar
Digital Library
- Robert Bruce Findler, Mario Latendresse, and Matthias Felleisen. 2001. Behavioral contracts and behavioral subtyping. In Proceedings of the 8th European Software Engineering Conference Held Jointly with the 9th ACM SIGSOFT International Symposium on Foundations of Software Engineering (ESEC/FSE-9). ACM, New York, NY, 229--236. DOI:http://dx.doi.org/10.1145/503209.503240 Google Scholar
Digital Library
- Cormac Flanagan, K. Rustan M. Leino, Mark Lillibridge, Greg Nelson, James B. Saxe, and Raymie Stata. 2002. Extended static checking for Java. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’02). 234--245. Google Scholar
Digital Library
- David Harel, Amir Pnueli, and Jonathan Stavi. 1977. A complete axiomatic system for proving deductions about recursive programs. In Proceedings of the 9th Annual Symposium on Theory of Computing (STOC’77). 249--260. Google Scholar
Digital Library
- Wim Hesselink. 1993. Programs, Recursion, and Unbounded Choice. Cambridge.Google Scholar
- Charles A. R. Hoare. 1972. Proofs of correctness of data representations. Acta Informatica 1, 4, 271--281. Google Scholar
Digital Library
- Atsushi Igarashi, Benjamin Pierce, and Philip Wadler. 2001. Featherweight Java: A minimal core calculus for Java and GJ. ACM Transactions on Programming Languages and Systems 23, 3, 396--459. Google Scholar
Digital Library
- Thomas Kleymann. 1999. Hoare logic and auxiliary variables. Formal Aspects of Computing 11, 541--566. Google Scholar
Cross Ref
- Gary T. Leavens. 1989. Verifying Object-Oriented Programs That Use Subtypes. Technical Report 439. Laboratory for Computer Science, Massachusetts Institute of Technology, Cambridge, MA.Google Scholar
- Gary T. Leavens. 1990. Modular Verification of Object-Oriented Programs with Subtypes. Technical Report 90-09. Department of Computer Science, Iowa State University, Ames, IA.Google Scholar
- Gary T. Leavens. 2006. JML’s rich, inherited specifications for behavioral subtypes. In Formal Methods and Software Engineering. Lecture Notes in Computer Science, Vol. 4260. Springer, 2--34. Google Scholar
Digital Library
- Gary T. Leavens, Albert L. Baker, and Clyde Ruby. 2006a. Preliminary design of JML: A behavioral interface specification language for Java. ACM SIGSOFT Software Engineering Notes 31, 3, 1--38. http://doi.acm.org/10.1145/1127878.11 Google Scholar
Digital Library
- Gary T. Leavens and Krishna Kishore Dhara. 2000. Concepts of behavioral subtyping and a sketch of their extension to component-based systems. In Foundations of Component-Based Systems, G. T. Leavens and M. Sitaraman (Eds.). Cambridge University Press, 113--135. Google Scholar
Digital Library
- Gary T. Leavens, David A. Naumann, and Stan Rosenberg. 2006b. Preliminary Definition of Core JML. CS Report 2006-07. Stevens Institute of Technology. Available at http://www.cs.stevens.edu/naumann/publications/SIT-TR-2006-07.pdf.Google Scholar
- Gary T. Leavens and William E. Weihl. 1995. Specification and verification of object-oriented programs using supertype abstraction. Acta Informatica 32, 8, 705--778. Google Scholar
Digital Library
- K. Rustan M. Leino. 1995. Toward Reliable Modular Programs. Technical Report Caltech-CS-TR-95-03. California Institute of Technology, Pasedena, CA. Google Scholar
- K. Rustan M. Leino. 2005. Efficient weakest preconditions. Information Processing Letters 93, 6, 281--288. Google Scholar
Digital Library
- K. Rustan M. Leino and Peter Müller. 2006. A verification methodology for model fields. In Programming Languages and Systems. Lecture Notes in Computer Science, Vol. 3924. Springer, 115--130. Google Scholar
Digital Library
- K. Rustan M. Leino and Greg Nelson. 2002. Data abstraction and information hiding. ACM Transactions on Programming Languages and Systems 24, 5, 491--553. Google Scholar
Digital Library
- Barbara Liskov. 1988. Data abstraction and hierarchy. ACM SIGPLAN Notices 23, 5, 17--34. Google Scholar
Digital Library
- Barbara H. Liskov and Jeannette M. Wing. 1994. A behavioral notion of subtyping. ACM Transactions on Programming Languages and Systems 16, 6, 1811--1841. Google Scholar
Digital Library
- Bertrand Meyer. 1985. Eiffel: A Langauge for Software Engineering. Technical Report TR-CS-85-19. University of California, Santa Barbara, CA.Google Scholar
- Bertrand Meyer. 1997. Object-Oriented Software Construction (2nd ed.). Prentice Hall, New York, NY. Google Scholar
Digital Library
- Carroll Morgan. 1988. The specification statement. ACM Transactions on Programming Languages and Systems 10, 3, 403--419. Google Scholar
Digital Library
- Carroll Morgan. 1994. Programming from Specifications (2nd ed.). Prentice Hall. Google Scholar
Digital Library
- Peter Müller. 2002. Modular Specification and Verification of Object-Oriented Programs. Lecture Notes in Computer Science, Vol. 2262. Springer-Verlag.Google Scholar
Cross Ref
- Peter Müller, Arnd Poetzsch-Heffter, and Gary T. Leavens. 2006. Modular invariants for layered object structures. Science of Computer Programming 62, 3, 253--286. http://dx.doi.org/10.1016/j.scico.2006.03.001. Google Scholar
Digital Library
- David A. Naumann. 2001. Calculating sharp adaptation rules. Information Processing Letters 77, 2--4, 201--208. Google Scholar
Digital Library
- David A. Naumann. 2005. Verifying a secure information flow analyzer. In Theorem Proving in Higher Order Logics. Lecture Notes in Computer Science, Vol. 3603. Springer, 211--226. Google Scholar
Digital Library
- David A. Naumann and Mike Barnett. 2006. Towards imperative modules: Reasoning about invariants and sharing of mutable state. Theoretical Computer Science 365, 1--2, 143--168. Google Scholar
Digital Library
- James Noble, Jan Vitek, and John Potter. 1998. Flexible alias protection. In ECOOP’98—Object-Oriented Programming. Lecture Notes in Computer Science, Vol. 1445. Springer, 158--185. Google Scholar
Digital Library
- Peter W. O’Hearn, John C. Reynolds, and Hongseok Yang. 2001. Local reasoning about programs that alter data structures. In Computer Science Logic. Lecture Notes in Computer Science, Vol. 2142. Springer, 1--19. Google Scholar
Digital Library
- Peter W. O’Hearn, Hongseok Yang, and John C. Reynolds. 2009. Separation and information hiding. ACM Transactions on Programming Languages and Systems 31, 3, 1--50. Google Scholar
Digital Library
- David von Oheimb and Tobias Nipkow. 2002. Hoare logic for NanoJava: Auxiliary variables, side effects and virtual methods revisited. In FME 2002: Formal Methods—Getting IT Right. Lecture Notes in Computer Science, Vol. 2391. Springer, 89--105. Google Scholar
Digital Library
- Ernst-Rüdiger Olderog. 1983. On the notion of expressiveness and the rule of adaptation. Theoretical Computer Science 24, 337--347.Google Scholar
Cross Ref
- Matthew Parkinson. 2005. Local Reasoning for Java. Technical Report 654. University of Cambridge Computer Laboratory.Google Scholar
- Matthew Parkinson and Gavin Bierman. 2008. Separation logic, abstraction and inheritance. In Proceedings of the ACM Symposium on Principles of Programming Languages (POPL’08). ACM, New York, NY, 75--86. Google Scholar
Digital Library
- Cees Pierik. 2006. Validation Techniques for Object-Oriented Proof Outlines. Ph.D. Dissertation, Universiteit Utrecht.Google Scholar
- Cees Pierik and Frank S. de Boer. 2005a. On behavioral subtyping and completeness. In Proceedings of the ECOOP Workshop on Formal Techniques for Java-Like Programs.Google Scholar
- Cees Pierik and Frank S. de Boer. 2005b. A proof outline logic for object-oriented programming. Theoretical Computer Science 343, 3, 413--442. Google Scholar
Digital Library
- Arnd Poetzsch-Heffter and Peter Müller. 1999. A programming logic for sequential Java. In Programming Languages and Systems. Lecture Notes in Computer Science, Vol. 1576. Springer, 162--176. Google Scholar
Digital Library
- Nadia Polikarpova, Julian Tschannen, Carlo A. Furia, and Bertrand Meyer. 2014. Flexible invariants through semantic collaboration. In FM 2014: Formal Methods. Lecture Notes in Computer Science, Vol. 8442. Springer, 514--530.Google Scholar
- Erik Poll. 2000. A coalgebraic semantics of subtyping. In CMCS 2000: Coalgebraic Methods in Computer Science. Electronic Notes in Theoretical Computer Science, Vol. 33. Elsevier, 276--293.Google Scholar
Cross Ref
- Bernhard Reus. 2003. Modular semantics and logics of classes. In Computer Science Logic. Lecture Notes in Computer Science, Vol. 2803. Springer, 456--469.Google Scholar
Cross Ref
- John C. Reynolds. 1972. Definitional interpreters for higher-order programming languages. In Proceedings of the ACM Annual Conference. Vol. 2. ACM, New York, NY, 717--740. Google Scholar
Digital Library
- John C. Reynolds. 1982. Idealized ALGOL and its specification logic. In Tools and Notions for Program Construction, D. Néel (Ed.). Cambridge University Press, 121--161. Reprinted in ALGOL-Like Languages, Vol. 1. Birkhauser, Boston, MA, 125--156. Google Scholar
Digital Library
- Peter Van Roy and Seif Haridi. 2004. Concepts, Techniques, and Models of Computer Programming. MIT Press. Google Scholar
Digital Library
- Alan Wills. 1992. Specification in Fresco. In Object Orientation in Z, S. Stepney, R. Barden, and D. Cooper (Eds.). Springer-Verlag, Cambridge, UK, 127--135. Google Scholar
Digital Library
- Jeannette Marie Wing. 1983. A Two-Tiered Approach to Specifying Programs. Technical Report TR-299. MIT Laboratory for Computer Science, Cambridge, MA. Google Scholar
- Job Zwiers, Ulrich Hannemann, Yassine Lakhnech, Willem P. de Roever, and Frank A. Stomp. 1996. Modular completeness: Integrating the reuse of specified software in top-down program development. In Proceedings of the 3rd International Symposium of Formal Methods Europe on Industrial Benefit and Advances in Formal Methods (FME’96). 595--608. http://dl.acm.org/citation.cfm?id=647537.729693. Google Scholar
Digital Library
Index Terms
Behavioral Subtyping, Specification Inheritance, and Modular Reasoning
Recommendations
Forcing behavioral subtyping through specification inheritance
ICSE '96: Proceedings of the 18th international conference on Software engineeringA common change to object-oriented software is to add a new type of data that is a subtype of some existing type in the program. However, due to message passing, unchanged pearls of the program may now call operations of the new type. To avoid ...
WP semantics and behavioral subtyping
ICTAC'11: Proceedings of the 8th international conference on Theoretical aspects of computingFor the object oriented (OO) world, developing formal semantics for theoretical study and practical use is still an important topic despite of a decade's efforts. In this paper, for a sufficiently large subset of sequential Java with a pure reference ...
Specification, Refinement and Verification of Concurrent Systems—An Integration of Object-Z and CSP
This paper presents a method of formally specifying, refining and verifying concurrent systems which uses the object-oriented state-based specification language Object-Z together with the process algebra CSP. Object-Z provides a convenient way of ...








Comments