26-27/05/2016 An incremental approach to Formal verification for Java applications Teodor Parvanov May ‘16, Sofia 1

26-27/05/2016 About me I currently work at VMware Bulgaria, working on standing up the fully automated Software-Defined Data Center (SDDC) University background in Maths/Physics & Computer science “made in France” => Unhealthy tendency towards modelling stuff using mathematical equations Computer programs being also “stuff”, why not try and model them with equations too (a.k.a Formal verification) ? 2

26-27/05/2016 Even deepest philosophical questions… 3

26-27/05/2016 An example from aerodynamics Longitudinal stability Required so that the pilot (and underlying electronic and mechanical systems) can keep the aircraft stable without significant intervention => simulation based on the laws of mechanics and aerodynamics 4

26-27/05/2016 Mathematical equations of stability 5

26-27/05/2016 So why not computer programs ? Formal verification is successfully applied in: HW industry Embedded SW Transportation systems Energy production Manufacturing “Mainstream” software is lagging behind: Banking, finance, insurance Healthcare Flight ticket reservations Electronic voting 6

26-27/05/2016 Java - let’s start simple ! 7

26-27/05/2016 Correct ? 8

26-27/05/2016 Can we specify this in mathematical terms? 9

26-27/05/2016 Disclaimer ! Use of mild mathematical language follows 10

26-27/05/2016 A calculus for computation? 11 We need a formal system (a calculus) to reason about correctness Logically proven correctness provides quality guarantees far beyond what any amount of testing can

26-27/05/2016 First-order logic (FOL) 12

26-27/05/2016 FOL examples 13

26-27/05/2016 Well, you know … 14

26-27/05/2016 Program correctness Specification The precise statement of the properties a program should exhibit Translates into a set of program annotations asserting properties over program variables The language of FOL provides precision Partial correctness (safety properties) If a program halts, then its output satisfies some relation with its input “Nothing bad happens” Total correctness (progress properties) Certain states are eventually reached during program execution “Something good eventually happens” 15

26-27/05/2016 Program correctness Specification The precise statement of the properties a program should exhibit Translates into a set of program annotations asserting properties over program variables The language of FOL provides precision Partial correctness (safety properties) If a program halts, then its output satisfies some relation with its input “Nothing bad happens” Total correctness (progress properties) Certain states are eventually reached during program execution “Something good eventually happens” 16

26-27/05/2016 Partial correctness notation 17

26-27/05/2016 First-Order Logic for Java JML (Java Modelling Language) Embedded as Java comments with or */ Java-like syntax extended with new keywords for specification: forall, exists, requires, ensures, \invariant, \loop_invariant, \pure… Implemented by the OpenJML library Supported annotations Method pre-/post-condition (e.g. requires x >= 0) Class invariant (e.g. this.accountBalance >= 0) 18

26-27/05/2016 Can we make all this a bit more precise ? 19

26-27/05/2016 Our first JML specification ! 20

26-27/05/2016 Incrementally leveraging JML annotations Very precise code documentation Actually such a specification exists for key parts of the JDK ! Javadoc can also be generated out of JML annotations Test suite generation (using JML as a test oracle) JMLUnitNG Jartege, Tobias Formal proof of correctness (could be justified for certain core components) manual automated (KeY, OpenJML) 21

26-27/05/2016 Demo time ! 22

26-27/05/2016 Key takeaways Formal specification is not that hard (and fun !) And Java supports it (via OpenJML) Formal specification can be introduced incrementally Possible areas of application Core project libraries Frameworks Mission-critical business logic (“pure” methods) 23

26-27/05/2016 Q & A 24

26-27/05/2016 THANK YOU :) You can find me at: Teodor Parvanov May ’16, Sofia 25