The KeY project Sequent calculus Java Card DL Updates The active - PowerPoint PPT Presentation

The KeY project G´ abor Angyal Introduction History Material The KeY project JavaCard JML The KeY project Sequent calculus Java Card DL Updates The active statement The Assignment Rule The Rule for if-else G´ abor Angyal Loops Unwinding while loops Loop Invariants End June 15, 2011

The KeY project History G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL • Formal software development tool Updates The active statement The Assignment Rule • University of Karlsruhe (1998) The Rule for if-else Loops Unwinding while • Karlsruhe Institute of Technology and Chalmers loops Loop Invariants University of Technology, Gothenburg End

The KeY project Material G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL Updates • KeY quick tour The active statement The Assignment Rule The Rule for if-else • ”The KeY Tool” paper Loops Unwinding while loops http://key-project.org/ Loop Invariants End

The KeY project The KeY project G´ abor Angyal Introduction History Material The KeY project • Verification of formal specification JavaCard JML Sequent calculus • Automated and interactive mode Java Card DL Updates • JavaCard The active statement The Assignment Rule • JML The Rule for if-else Loops Unwinding while loops Loop Invariants End

The KeY project JavaCard G´ abor Angyal Introduction History Material The KeY project • Java-based applications JavaCard JML Sequent calculus • Smart Cards Java Card DL Updates The active statement The language The Assignment Rule The Rule for if-else Loops • Precise subset of Java Unwinding while loops Loop Invariants • Missing types char, double, float and long End • Missing features transient qualifier; enums; arrays of more than one dimension; finalization; object cloning; threads

The KeY project JML - proof obligations G´ abor Angyal Introduction History Example Material The KeY project JavaCard /*@ JML Sequent calculus @ public normal_behavior Java Card DL @ requires idx < int_list.length; Updates @ assignable idx , int_list; The active statement @ ensures idx == \old(idx) + 1; The Assignment Rule The Rule for if-else @ ensures int_list [\ old(idx )] == v; Loops @*/ Unwinding while loops add ( i n t v ) Exception p u b l i c void throws Loop Invariants { End i f ( i d x < i n t l i s t . l e n g t h ) { i n t l i s t [ i d x ] = v ; i d x++; } e l s e Exception ( ” Array i s f u l l . ” ) ; throw new }

The KeY project JML G´ abor Angyal Introduction History Material Loop invariant The KeY project JavaCard JML Sequent calculus max value = i n t l i s t [ 0 ] ; i n t i n t i= 0 ; Java Card DL Updates The active statement /*@ loop_invariant 0<=i && i<idx && The Assignment Rule The Rule for if-else @ (\ forall int j; j >=0 && j<i; int_list[j] <= max_value ); Loops @ assignable max_value , i; Unwinding while loops */ Loop Invariants while ( i < i d x ) End { i = i + 1; g = i n t l i s t [ i ] ; i n t i f ( max value < g ) max value = g ; }

The KeY project Sequent calculus G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL Form Updates The active statement φ 1 , ..., φ m ⊢ ψ 1 , ..., ψ n (m, n ≥ 0) The Assignment Rule The Rule for if-else Loops Unwinding while Sematics loops Loop Invariants φ 1 ∧ ... ∧ φ m → ψ 1 ∨ ... ∨ ψ n (m, n ≥ 0) End

The KeY project JavaCardDL G´ abor Angyal Introduction History Material The KeY project JavaCard JML typed first-order dynamic logic Sequent calculus Java Card DL Additional operators Updates The active statement The Assignment Rule The Rule for if-else • � p � φ means that program p terminates and in its Loops Unwinding while final state formula φ holds. loops Loop Invariants End • [ p ] φ means that if program p terminates then in its final state formula φ holds.

The KeY project Updates G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Syntax Java Card DL Updates The active statement { v 1 := ϕ 1 � ... � v m := ϕ 1 }� p � φ The Assignment Rule The Rule for if-else { v 1 := ϕ 1 � ... � v m := ϕ 1 } [ p ] φ Loops Unwinding while loops Example Loop Invariants End { i := a � j := b }� tmp = i ; i = j ; j = tmp ; � i = b & j = a

The KeY project The Active Statement in a Program G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL • π p ω - program Updates The active statement The Assignment Rule • π - non-active prefix The Rule for if-else Loops • p - active statement Unwinding while loops Loop Invariants • ω - the rest End

The KeY project The Assignment Rule G´ abor Angyal Introduction History Material The KeY project JavaCard JML The aliasing problem Sequent calculus Java Card DL Does ” o 1 . a = 1” still holds after the execution of the Updates The active statement assignment ” o 2 . a = 2”? The Assignment Rule The Rule for if-else Loops Transform it to an update Unwinding while loops Loop Invariants End Γ ⊢ { ξ � p }� πω � φ Γ ⊢ { ξ }� π p ω � φ

The KeY project The Rule for if-else G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL Updates The active statement The Assignment Rule Γ , b ⊢ { ξ }� π p ω � φ ; Γ , ! b ⊢ { ξ }� π q ω � φ The Rule for if-else Loops Γ ⊢ { ξ }� π if ( b ) p else q ω � φ Unwinding while loops Loop Invariants End

The KeY project Unwinding while loops G´ abor Angyal Introduction History Material The KeY project JavaCard JML i f ( b ) Sequent calculus { Java Card DL while ( b ) d o s t u f f ; Updates { } The active statement The Assignment Rule d o s t u f f ; while ( b ) The Rule for if-else } { Loops d o s t u f f ; Unwinding while loops } Loop Invariants End • Apply if-else rule. • Apply assignment rules.

The KeY project Loop Invariants G´ abor Angyal Introduction History Material { ξ }� while ( b ) { do stuff ; }� φ The KeY project JavaCard JML Sequent calculus Java Card DL • P - Loop invariant Updates The active statement • t - variant The Assignment Rule The Rule for if-else Loops such that ... Unwinding while loops Loop Invariants End • P is initially valid • The body of the loop must preserve P • The body of the loop must decrease t • P ∧ b ⇒ t > 0 • P ∧ t = 0 ⇒ φ

The KeY project G´ abor Angyal Introduction History Material The KeY project JavaCard JML Sequent calculus Java Card DL Updates The active statement The Assignment Rule The Rule for if-else Loops Unwinding while loops Loop Invariants End