Enhancing a behavioral interface specification language with temporal logic features

As a Behavioral Interface Specification Language (BISL) for Java, the Java Modeling Language (JML) is tightly coupled to the base language it enhances. Up until Java 1.4, JML kept apace with the evolution of its base language. Java 5 and subsequent revisions have yet to be fully supported by JML tools. Recent efforts such as JML4 have been addressing this issue by providing an Eclipse-based tooling infrastructure. In its current form, JML4 has a fairly steep learning curve for developers wishing to contribute to or extend it. To address this issue and bring JML tools one step closer to a desired plug-in model, we propose a JML Intermediate Representation (JIR) and supporting software infrastructure for JML front-ends and back-ends.

The Java Modeling Language (JML) is a notation for specifying and describing the detailed design and implementation of Java modules. An important language design goal of JML has been to preserve the semantics of Java to the extent possible. Thus, in particular, Java numeric expressions have the same meaning in JML. We illustrate how such a semantics fails to match the expectations of specification authors and readers who generally think in terms of arbitrary precision arithmetic (rather than the fixed precision provided by Java). As a result, an unusually high number of published JML specifications are invalid or inconsistent, including cases from the security critical area of smart card applications. We briefly examine JML’s ancestry and language design principles; this helps to explain the origin of the semantic gap between user expectations and the current meaning given to JML numeric expressions. With the objective of better matching user expectations we introduce JMLb, a variant of JML supporting primitive arbitrary precision numeric types as well as “math modes” to control the semantics of arithmetic expressions. This is done in a manner that is consistent with JML’s language design goals. A semantics of JMLb expressions is given by means of an embedding into PVS. The problem presented here will arise in the design of most interface specification languages that must deal with, e.g., mathematical integers in specifications and their fix precision approximations in code. We examine how the problem may manifest itself in other languages (such as Eiffel, Spark and the UML/OCL-Java notation of the KeY project) and comment on the applicability of our solution.

The Object Constraint Language (OCL) is a formal specification language that could be used for constraining the modelling elements that occur in UML diagrams. The Java Modeling Language (JML) is a behavioural interface specification language designed for specifying Java classes and interfaces. This paper investigates the mapping of OCL constraints to JML constraints together with its properties. In particular the paper shows how those constructs such as iterators that are not directly supported by JML are transformed to an equivalent form that can be mapped directly to JML. The paper proposes a special library for OCL types implemented in Java that facilitates the mapping. Extracts from a case study was used to illustrate the mapping

Formal methods for smart cards: an experience report

The idea behind Design by Contract (DbC) is that a method defines a contract stating the requirements a client needs to fulfill to use it, the precondition, and the properties it ensures after its execution, the post condition. Though there exists ample support for DbC for sequential programs, applying DbC to concurrent programs presents several challenges. We have proposed a solution to these challenges in the context of Java as programming language and the Java Modeling language as specification language. This paper presents our findings when applying our DbC technique on an industrial case study to evaluate the ability of contract-based, runtime assertion checking code at detecting and diagnosing race conditions and deadlocks during system testing. The case study is a highly concurrent industrial system from the telecommunications domain, with actual faults. It is the first work to systematically investigate the impact of contract assertions for the detection of race conditions and deadlocks, along with functional properties, in an industrial system.

Model checkers achieved a great success in verification of control-flow properties such as reach ability of error states, but few of them are capable of handling data structural properties such as ``the procedure preserves the sorted ness of linked lists''. On the other hand, specification languages like Java Modeling Language (JML) can express such property, and deductive verification tools like Spec# and Frama-C can prove properties expressed in such language. But these tools in general do not produce counter-examples when the proof attempts fails. This paper proposes a bounded model checker CForge and its specification language, aiming in the middle of these two approaches. The language has JML-like syntax extended with C-specific constructs and is designed to be suited for model checking. This allows writing data structural properties neatly using quantifiers, relational operations, etc., while enjoying the benefit of model checkers. As an experiment, we wrote specifications for ten programs, each of which contained one non-trivial bug such as a sorting failure, wrong manipulation of a linked list, etc. and checked them using CForge. CForge detected seven out of the ten bugs. The result shows that our language and tool are capable of specifying and checking complex properties.

We present an original approach for the automated computation of model-based test cases from specifications written in Java Modeling Language (JML). We aim at activating all the behaviors from the JML method specifications. Therefore, we extract each behavior and we compute the pertinent test data for the input parameters; we select the boundary values of the ordered domains, and we consider specific features for the objects, involving inheritance and aliasing. Finally, a preamble for each test case is computed by symbolic animation of the JML specification using constraint logic programming techniques. Thus, we are able to automatically generate executable Java test sequences to be run on the system under test. Moreover, this process requires the less possible intervention from a validation engineer.KeywordsTest generationmodel-basedJava Modeling Languageautomatedboundary values

This paper proposes a way to verify temporal properties of a Java class in an extension of JML (Java Modeling Language) called JTPL (Java Temporal Pattern Language). We particularly address the verification of liveness properties by automatically translating the temporal properties into JML annotations for this class. This automatic translation is implemented in a tool called JAG (JML Annotation Generator). Correctness of the generated annotations ensures that the temporal property is established for the executions of the class in isolation.

SummaryIn order to claim conformance with a Java Specification Request, a Java implementation has to pass all tests in an associated Technology Compatibility Kit. This paper presents a model‐based development of a Technology Compatibility Kit test suite and a test execution tool for the draft safety‐critical Java profile specification. The Java Modeling Language is used to model conformance constraints for the profile. Java Modeling Language annotations define contracts for classes and interfaces. The annotations are translated by a tool into runtime assertion checks. Hereby, the design and elaboration of the concrete test cases are simplified, because the expected results are derived from contracts and thus do not need to be provided explicitly. Bottom‐up testing is applied for testing methods of the safety‐critical Java classes, whereas top‐down testing is applied for testing global properties, such as protocols, memory management, and real‐time properties, including scheduling. The tests are executed using a simplified version of JUnit, which makes the test suite executable on resource‐constrained platforms. Copyright © 2017 John Wiley & Sons, Ltd.

Testing and verification are two activities which have the same objective: to ensure software dependability. In the Java context, the Java Modelling Language (JML) has been proposed as specification language. It can be used both for verification and test. Usually, the JML specification is designed with a specific purpose: test or verification. This article addresses the question of reusability of a JML specification provided for one activity (resp. verification or test) in the other context (resp. test or verification). Two different case studies are considered.

In this thesis, we introduce and examine four new temporal logic formalisms that can be used as specification languages for the automated verification of the reliability of hardware and software designs with respect to a desired behavior. The work is organized in two parts. In the first one, we reason about two logics for computations, GCTL* and MCTL*, which are useful to describe a correct execution of monolithic closed systems. In the second one, instead, we focus on two logics for strategies, SL and mATL*, which are useful to formalize several interesting properties about interactive plays in multi-entities systems modeled as multi-agent games. In the “Logics for Computations” part, we first study the immersion of the idea of graded quantifications into the temporal-logic framework. In first order logic, existential and universal quantifiers express the concepts of the existence of at least one individual object satisfying a formula, or that all individual objects satisfy a formula. In other logics, these quantifiers have been generalized to express that, for a given non-negative integer n, at least n or all but n individuals satisfy a particular formula. Here, we consider GCTL, a temporal logic with graded path quantifiers, which allows to describe properties like “there exist at least n different classes of computational fluxes in which a system reaches a predetermined state”, where the classes over paths are computed by means of a predetermined equivalence relation. More precisely, we uniformly extend the classic concept of graded quantifiers from states to paths, through the use of a concept of path equivalence with respect to a given path formula. About this logic, in particular, we study the expressiveness and succinctness relationships with respect to GµCalculus and the complexity of the satisfiability problem, which results to be ExpTime-Complete. This research is partially based on the works [BMM09] “Graded Computation Tree Logic” and [BMM10] “Graded Computation Tree Logic with Binary Coding” published, respectively, in the proceedings of the “IEEE Symposium on Logic in Computer Science, 2009” and “EACSL Annual Conference on Computer Science Logic, 2010”. Preliminary results can be also found in [Mog07]. Furthermore, we consider special quantifiers over substructures, which allow to select, using parametric criteria, small critical parts of a system to be successively verified. In literature, there are some attempts to define a logic that allows to modify the underlying structure under exam and then to verify on it some assigned property. However, as far as we know, none of them is able to select minimal submodels of a given property describing the criteria on which then execute the verification process. Here, we base our work on the search of a new operator that merges the concept of quantifiers on structures with that one derived by a generalization of the concept of pruning. The results of this work, is a class of three different extensions of CTL* with minimal model quantifiers, which we name MCTL*. Regarding these logics, we study several reductions among them, as well as the satisfiability problem that we prove to be highly undecidability, i.e., Σ_1^1-Hard, for two out of the three cases. This research is partially based on the work [MM09] “Branching-Time Temporal Logics with Minimal Model Quantifiers” published in the proceedings of the “International Conference on Developments in Language Theory, 2009”. In the “Logics for Strategies” part, we first study the problem of defining a new specification language through which it is possible to express several important properties of multi-entities systems that are neither expressible using classical monolithic temporal logics, such as CTL*, nor using two-agent-teams temporal logics, such as ATL*. In literature, we can found some proposal of logics that try to achieve this goal, but unfortunately, none of them succeeds completely on all the aspects. Among them, one of the most important attempts is CHP-SL, a logics in which one can use variables over strategies. However, this logic has a deep weakness, since it does not allow to describe games with more than two players and even two-players concurrent games. Here, we introduce SL, a logic with a syntax similar in some aspects to the first order logic, in which the strategies of the agent building the game are treated as first order objects on which we can quantify. This logic generalizes CHP-SL, by allowing the specification of the correct behavior of multi-agent concurrent games. In SL, for example, we are able to express very complex but useful Nash equilibria that are not expressible with CHP-SL. We enlighten that Nash equilibrium is one of the most important concepts in game theory. For the introduced logic, we solve two problems left open in the work on CHP-SL. Precisely, we show that the related model-checking problem is 2ExpTime-Complete, thus not harder of the same problem for several subsumed logics, while we prove that its satisfiability problem is highly undecidable, i.e., Σ_1^1-Hard. This research is partially based on the work [MMV10a] “Reasoning About Strategies” published in the proceedings of the “IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science, 2010”. Finally, we consider the concept of relentful strategic reasoning, i.e., a formalism that expresses the ability of a strategy to be used not only to achieve a first given goal, but also to change its final goal in dependence of the history of the play. In the context of planning, memoryful quantification, i.e., quantification over computations that does not lose information about the past along the time, is one of the principal way to express the fact that a system is able to achieve a desired result, and shift to a different goal if some event happens. However, this kind of quantification was not considered before in the context of multi-agent planning. Here, we introduce mATL*, a fusion of the classic alternating temporal logic ATL* with memoryful quantification, with the aim of covering the previous idea. About this logics, we prove that, although it is equivalent to ATL*, it is exponentially more succinct. Nevertheless, we prove that both the model-checking and the satisfiability problems remain 2ExpTime-Complete, as for ATL*. This research is partially based on the work [MMV10b] “Relentful Strategic Reasoning in Alternating-Time Temporal Logic” published in the proceedings of the “International Conference on Logic for Programming Artificial Intelligence and Reasoning, 2010”.

This paper presents Salt. Salt is a general purpose specification and assertion language developed for creating concise temporal specifications to be used in industrial verification environments. It incorporates ideas of existing approaches, such as specification patterns, but also provides nested scopes, exceptions, support for regular expressions and real-time. The latter is needed in particular for verification tasks to do with reactive systems imposing strict execution times and deadlines. However, unlike other formalisms used for temporal specification of properties, Salt does not target a specific domain. The paper details on the design rationale, syntax and semantics of Salt in terms of a translation to temporal (real-time) logic, as well as on the realisation in form of a compiler. Our results will show that the higher level of abstraction introduced with Salt does not deprave the efficiency of the subsequent verification tools—rather, on the contrary.

Manipulation planning from high-level task specifications, even though highly desirable, is a challenging problem. The large dimensionality of manipulators and complexity of task specifications make the problem computationally intractable. This work introduces a manipulation planning framework with linear temporal logic (LTL) specifications. The use of LTL as the specification language allows the expression of rich and complex manipulation tasks. The framework deals with the state-explosion problem through a novel abstraction technique. Given a robotic system, a workspace consisting of obstacles, manipulable objects, and locations of interest, and a co-safe LTL specification over the objects and locations, the framework computes a motion plan to achieve the task through a synergistic multi-layered planning architecture. The power of the framework is demonstrated through case studies, in which the planner efficiently computes plans for complex tasks. The case studies also illustrate the ability of the framework in intelligently moving away objects that block desired executions without requiring backtracking.

Sequential reactive systems include programs and devices that work with two streams of data and convert input streams of data into output streams. Such information processing systems include controllers, device drivers, computer interpreters. The result of the operation of such computing systems are infinite sequences of pairs of events of the request-response type, and, therefore, finite transducers are most often used as formal models for them. The behavior of transducers is represented by binary relations on infinite sequences, and so, traditional applied temporal logics (like HML, LTL, CTL, mu-calculus) are poorly suited as specification languages, since omega-languages, not binary relations on omega-words are used for interpretation of their formulae. To provide temporal logics with the ability to define properties of transformations that characterize the behavior ofreactive systems, we introduced new extensions ofthese logics, which have two distinctive features: 1) temporal operators are parameterized, and languages in the input alphabet oftransducers are used as parameters; 2) languages in the output alphabet oftransducers are used as basic predicates. Previously, we studied the expressive power ofnew extensions Reg-LTL and Reg-CTL ofthe well-known temporal logics oflinear and branching time LTL and CTL, in which it was allowed to use only regular languages for parameterization of temporal operators and basic predicates. We discovered that such a parameterization increases the expressive capabilities oftemporal logic, but preserves the decidability of the model checking problem. For the logics mentioned above, we have developed algorithms for the verification of finite transducers. At the next stage of our research on the new extensions of temporal logic designed for the specification and verification of sequential reactive systems, we studied the verification problem for these systems using the temporal logic Reg-CTL*, which is an extension ofthe Generalized Computational Tree Logics CTL*. In this paper we present an algorithm for checking the satisfiability of Reg-CTL* formulae on models of finite state transducers and show that this problem belongs to the complexity class ExpSpace.

Rational verification involves checking which temporal logic properties hold of a concurrent and multiagent system, under the assumption that agents in the system choose strategies in game theoretic equilibrium. Rational verification can be understood as a counterpart of model checking for multiagent systems, but while model checking can be done in polynomial time for some temporal logic specification languages such as CTL, and polynomial space with LTL specifications, rational verification is much more intractable: it is 2EXPTIME-complete with LTL specifications, even when using explicit-state system representations. In this paper we show that the complexity of rational verification can be greatly reduced by restricting specifications to GR(1), a fragment of LTL that can represent most response properties of reactive systems. We also provide improved complexity results for rational verification when considering players' goals given by mean-payoff utility functions -- arguably the most widely used quantitative objective for agents in concurrent and multiagent systems. In particular, we show that for a number of relevant settings, rational verification can be done in polynomial space or even in polynomial time.