methodcallsandmodelelds.PDF

Vol. 4, No. 8, September–October 2005 Reasoning with speci?cations containing method calls and model ?elds David R. Cok, B65 MC01816, Eastman Kodak Company, Research Devel- opment Laboratories, Rochester, NY 14650-1816, USA, cok@ Allowing abstraction in program speci?cations increases modularity and comprehen- sibility and is as important in speci?cations as it is in the program itself; two such abstraction mechanisms are method invocations and model ?elds. However, method invocations do not map neatly into the ?rst-order logics that are often used for assuring the correctness of speci?cations. One problem is translating speci?cations in a way that acknowledges the potential for exceptional behavior. Furthermore, translating model ?elds into veri?cation conditions exposes the non-trivial interactions between frame conditions and the model representations. The ESC/Java2 tool has been able to achieve a practical translation of method invocations and model ?elds within the design constraints of its parent tool, ESC/Java. Furthermore, the techniques used are applicable to other speci?cation constructs such as generalized quanti?ers. 1 INTRODUCTION Research and practical capability in program veri?cation is advancing signi?cantly with the help of clearer semantics, evolution of languages and tools, and experience with industrial-scale software systems. One research thread in program veri?ca- tion combines (a) speci?cations indicating the intent of a program with (b) tools that check those speci?cations either dynamically at run-time or statically with- out needing to execute the program. Using method calls in speci?cations provides a level of abstraction and conciseness that promotes reading, writing and under- standing speci?cations and will likely assist in their automated veri?cation as well. However, method calls in spec