Accessible Formal Methods A Study of the Java Modeling Language Mike Rawding Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Outline Project Selection and Goals JML Background Introduction to JML OpenJML Some Examples (Demo) Specifying StringBuilder Results Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Project Selection Took a course on Formal Methods JML struck me as usable/practical Originally planned to specify and check existing software Decided to specify part of the standard library Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 JML Background Introduced 1999 by Gary Leavens (Iowa State University) Saw a need for a Java specific specification language Outlined the language first Produced original tools jmlc and jmlunit ESC/Java was adapted for JML Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Format JML lives within special Java comments starting with ‘@’ //@ /*@ */ Specifications may be written directly in line with source code (.java) or in a stand alone specification file (.jml) Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Method Interfaces Preconditions what is required as the method begins execution Postconditions what is the guaranteed outcome of this method Side Effects what may this method change (e.g. state) Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 User Object String name int age int numLogins The usual setters/getters Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Preconditions Predicates defined with the requires clause Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Postconditions Predicates defined with the ensures clause Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Side Effects Defined with the assignable clause Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Side Effects If a method never has side effects, it may be marked pure Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Side Effects Specifications may not cause side effects May not assign variables May only call pure methods Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Visibility Specifications have visibility just like other Java elements May be implied or explicit Not allowed to reveal fields that are more restricted than the specification Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Multiple Behaviors Multiple behaviors may be defined based on preconditions Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Class Invariants Predicates defined with the invariant keyword Must hold for all visible states Universal preconditions and postconditions Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 OpenJML Previous tools are dead jmlc jmlunit JMLUnitNG jmldoc ESC/Java ESC/Java2 OpenJML current toolkit for dealing with JML Eclipse Plugin and Command Line Interface JML type checking Runtime Assertion Checking (RAC) Extended Static Checking (ESC) Mike Rawding - SUNY Polytechnic Institute - May 2017

Adding Library Specifications When checking new specifications, JML assumes existing specifications to be true If no specification is given, no assumptions can be made When working with unspecified libraries user will get lots of JML errors Can be hard to tell if their new code is really flawed (misusing a library) Mike Rawding - SUNY Polytechnic Institute - May 2017

Adding Library Specifications Above all else, specifications must be accurate Other specifications depend on this As complete as possible Ideally specify all possible behaviors of methods Mike Rawding - SUNY Polytechnic Institute - May 2017

Adding Library Specifications Start with invariants Take advantage of lightweight specifications and iterate over adding more detail Must create a driver program that uses (and misuses) all methods Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Demo Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Results Added StringBuilder support to OpenJML All specifications and drivers demonstrating their correctness have been submitted to the owner of the OpenJML project Expected to be merged into the general JML spec repository Demonstrated usability of JML Provided feedback and bug reports to OpenJML project Mike Rawding - SUNY Polytechnic Institute - May 2017

Mike Rawding - SUNY Polytechnic Institute - May 2017 Bugs Reported ESC reports errors with incorrect line numbers During ESC, user unable to maintain focus on console ESC error dereferencing arguments in specifications even if the behavior clause has defined them as not null An identifier with public visibility may not be used in a invariant clause with package visibility RAC does not correctly check side effects RAC causes Java exceptions when accessing hidden attributes that have been marked spec_public ESC may behave differently depending on order of code OpenJML bug #502 Mike Rawding - SUNY Polytechnic Institute - May 2017

Enhancements Suggested Better error reporting on compile errors Error code 4, internal JML error A console tab the contains only output from previous RAC/ESC During ESC, user unable to maintain focus on console Add warning that indicates if a failure is based on an unspecified method (still concerning, but less likely to be a legitimate error) Integrating JMLDoc with OpenJML would be extremely useful Mike Rawding - SUNY Polytechnic Institute - May 2017