## Proving theorems about Java and the JVM with ACL2 (2003)

Venue: | Models, Algebras and Logic of Engineering Software |

Citations: | 19 - 10 self |

### BibTeX

@INPROCEEDINGS{Moore03provingtheorems,

author = {J Strother Moore},

title = {Proving theorems about Java and the JVM with ACL2},

booktitle = {Models, Algebras and Logic of Engineering Software},

year = {2003},

pages = {227--290},

publisher = {IOS Press}

}

### OpenURL

### Abstract

We describe a methodology for proving theorems mechanically about Java methods. The theorem prover used is the ACL2 system, an industrial-strength version of the Boyer-Moore theorem prover. An operational semantics for a substantial subset of the Java Virtual Machine (JVM) has been defined in ACL2. Theorems are proved about Java methods and classes by compiling them with javac and then proving the corresponding theorem about the JVM. Certain automatically applied strategies are implemented with rewrite rules (and other proof-guiding pragmas) in ACL2 “books” to control the theorem prover when operating on problems involving the JVM model. The Java Virtual Machine or JVM [27] is the basic abstraction Java [17] implementors are expected to respect. We speculate that the JVM is an appropriate level of abstraction at which to model Java programs with the intention of mechanically verifying their properties. The most complex features of the Java subset we handle – construction and initialization of new objects, synchronization, thread management, and virtual method invocation – are all supported directly and with full abstraction as single atomic instructions in the JVM. The complexity of verifying JVM bytecode program stems from the complexity of Java’s semantics, not

### Citations

1615 |
The Java Language Specification
- Team, Gosling, et al.
- 1996
(Show Context)
Citation Context ... (and other proof-guiding pragmas) in ACL2 “books” to control the theorem prover when operating on problems involving the JVM model. The Java Virtual Machine or JVM [27] is the basic abstraction Java =-=[17]-=- implementors are expected to respect. We speculate that the JVM is an appropriate level of abstraction at which to model Java programs with the intention of mechanically verifying their properties. T... |

534 | PVS: A Prototype Verification System
- Owre, Rushby, et al.
- 1992
(Show Context)
Citation Context ... which translates Java and JML (a specification language tailored to Java) classes into their semantics in higher order logic. As such, LOOP can be used as a front end for such theorem provers as PVS =-=[37]-=- and Isabelle [36]. However, LOOP currently deals only with sequential Java. Other related work include [38, 1], where models of the JVM are formalized in Isabelle and Coq [12]. In both efforts, the c... |

500 |
T.: Introduction to HOL: A Theorem Proving Environment for Higher Order Logic: Cambridge
- Melham
- 1993
(Show Context)
Citation Context ...system for one of them is enormous and that work is error-prone and obscure. Techniques such as those described here will eventually enable general purpose theorem provers such as ACL2, Coq [12], HOL =-=[16]-=-, or PVS [37], to be used as specialpurpose reasoning engines for particular programming languages. In principle, it should be possible to develop a code verification system for a given language merel... |

292 | Extended static checking
- Detlefs, Leino, et al.
- 1998
(Show Context)
Citation Context ...n on the Athlon is compliant with the IEEE 754 floating-point standard [39]. We now turn to related mechanized formal JVM work other than that by the ACL2 community. The Extended Static Checker (ESC) =-=[11]-=- is an example of a formal, practical and mechanized tool for establishing certain simple assertions about Modula-3 programs. It is the basissProving Theorems about Java and the JVM 33 class Demo stat... |

262 |
Computer-Aided Reasoning: An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ... (in the case of threads) uncertainty in the Java community as to the desired standard. We model the JVM in ACL2, A Computational Logic for Applicative Common Lisp, by Matt Kaufmann and J Moore. ACL2 =-=[25]-=- is the industrial-strength successor to the BoyerMoore theorem prover, Nqthm [6]. ACL2 is a first-order applicative programming language based on Common Lisp. It is also a mathematical logic for whic... |

158 | Towards a Mathematical Science of Computation
- McCarthy
- 1962
(Show Context)
Citation Context ... implemented a variety of proof techniques for the JVM. 4 Our Formal Model of the JVM We model the JVM operationally. Formally modeling computing machines operationally has a long tradition. McCarthy =-=[31]-=- said “The meaning of a program is defined by its effect on the state vector.” The first mechanized formal model of the JVM was Cohen’s “defensive JVM” [10] in ACL2. Cohen’s machine includes type tags... |

145 |
Yellim F.: Java Virtual Machine Specification Second Edition
- Lindholm
- 2004
(Show Context)
Citation Context ... are implemented with rewrite rules (and other proof-guiding pragmas) in ACL2 “books” to control the theorem prover when operating on problems involving the JVM model. The Java Virtual Machine or JVM =-=[27]-=- is the basic abstraction Java [17] implementors are expected to respect. We speculate that the JVM is an appropriate level of abstraction at which to model Java programs with the intention of mechani... |

100 | Java PathFinder - second generation of a Java model checker
- Visser, Havelund, et al.
- 2000
(Show Context)
Citation Context ... (SRC) in Palo Alto, CA. ESC/Java is being extended in a tool named Calvin, by Shaz Qadeer, at SRC, to support assume-guarantee style reasoning about Java [private communication]. The Java PathFinder =-=[8, 44]-=- (JPF) is an explicit-state model-checker for programs written in Java. It can check certain kinds of invariants and deadlock. A tool with similar functionality is Bandera [13]. Both of these model-ch... |

90 |
ESC/Java user’s manual
- Leino, Nelson, et al.
- 2000
(Show Context)
Citation Context ... int fact(int n) if (n>0) return n*fact(n-1); else return 1; public static void main(String[] args) int k = 4; ans = fact(k+1); return; Figure 1: A Recursive Factorial Method of the ESC/Java verifier =-=[26]-=- for Java, developed at the Compaq (now HP) Systems Research Center (SRC) in Palo Alto, CA. ESC/Java is being extended in a tool named Calvin, by Shaz Qadeer, at SRC, to support assume-guarantee style... |

78 | Automated proofs of object code for a widely used microprocessor
- Boyer, Yu
- 1996
(Show Context)
Citation Context ... the JVM model’s behavior when interpreting that bytecode. The practicality of this approach to code verification was first demonstrated for a commercially interesting programming language by Yuan Yu =-=[7]-=-. He verified 21 of the 22 Berkeley C String Library programs by translating them into machine code for the Motorola 68020, using gcc -o, and verifying the resulting binary images with respect to an o... |

63 | Tool-supported program abstraction for finite-state verification - Dwyer, Hatcliff, et al. - 2001 |

50 |
The Coq proof assistant user's guide. Version 5.8
- Dowek, Felty, et al.
- 1993
(Show Context)
Citation Context ... theorem provers as PVS [37] and Isabelle [36]. However, LOOP currently deals only with sequential Java. Other related work include [38, 1], where models of the JVM are formalized in Isabelle and Coq =-=[12]-=-. In both efforts, the correctness of the bytecode verifier is addressed and the JVM models are largely concerned with type correctness rather than full functionality. 5 An Example In this section we ... |

33 | Core semantics of multithreaded Java
- Manson, Pugh
- 2001
(Show Context)
Citation Context ...The official JVM memory model, which is described in Chapter 17 of [27], does not require this and probably will not require it for arbitrary programs. The official JVM memory model is under revision =-=[30]-=- and will probably require that any execution of a “correctly synchronized” program must be equivalent to some interleaved bytecode execution. The memory model is under revision . For details see www.... |

31 | Partial functions in ACL2
- Manolios, Moore
(Show Context)
Citation Context ...on the in situ quicksort algorithm [42]. Rob Sumners is also using methods similar to those described in [29] to obtain a progress property for the Apprentice system based on the invariant proved. In =-=[28]-=- we describe a method for introducing tail-recursive functions that do not necessarily terminate. Such functions can be used to model single-threaded machines without introducing the notion of a “cloc... |

30 | A Verified Operating System Kernel
- Bevier
- 1987
(Show Context)
Citation Context ...ls and their interpretation of programs. During the 1980s and 1990s the Boyer-Moore community modeled several microprocessors and other computing machines and developed techniques for managing proofs =-=[22, 3, 46, 4, 23, 7, 45, 9]-=-. The techniques are described in [5]. A good example of the application of these techniques to another commercial language is provided by Yu’s work [7] in which 21 of the 22 Berkeley C String Library... |

30 | A mechanically checked proof of the correctness of the kernel of the AMD5k86 floating-point division algorithm
- Moore, Lynch, et al.
- 1998
(Show Context)
Citation Context ...e and inaccurate. We are working on improving the accuracy of our model. The current model omits support for floating point data. ACL2 has been used extensively to do floating-point verification work =-=[14, 41, 40, 39, 34]-=- and adding floating-point to our JVM model would not be difficult. The current model omits support for syntactic typing but we currently have a prototype model that addresses this problem. In the mod... |

28 | Mechanized formal reasoning about programs and computing machines
- Boyer, Moore
- 1996
(Show Context)
Citation Context ...1990s the Boyer-Moore community modeled several microprocessors and other computing machines and developed techniques for managing proofs [22, 3, 46, 4, 23, 7, 45, 9]. The techniques are described in =-=[5]-=-. A good example of the application of these techniques to another commercial language is provided by Yu’s work [7] in which 21 of the 22 Berkeley C String Library subroutines were verified by mechani... |

27 | A formal HDL and its use in the FM9001 verification
- Hunt, Brock
- 1992
(Show Context)
Citation Context ...ls and their interpretation of programs. During the 1980s and 1990s the Boyer-Moore community modeled several microprocessors and other computing machines and developed techniques for managing proofs =-=[22, 3, 46, 4, 23, 7, 45, 9]-=-. The techniques are described in [5]. A good example of the application of these techniques to another commercial language is provided by Yu’s work [7] in which 21 of the 22 Berkeley C String Library... |

26 | High-speed, analyzable simulators
- Greve, Wilding, et al.
- 2000
(Show Context)
Citation Context ...rams. The ACL2 model executed at approximately 90% of the speed of the previously used C model [20, 21]. Greve, Wilding, and Hardin describe how microprocessor models in ACL2 are made to execute fast =-=[19]-=-. The model there executes at approximately 3 million simulated instructions per second on a 728 MHZ Pentium III host running Allegro Common Lisp. At Rockwell not only are ACL2 models used for simulat... |

24 | Symbolic simulation of the JEM1 microprocessor
- Greve
- 1998
(Show Context)
Citation Context ... which Rockwell engineers tested the chip design against the requirements by executing compiled Java programs. The ACL2 model executed at approximately 90% of the speed of the previously used C model =-=[20, 21]-=-. Greve, Wilding, and Hardin describe how microprocessor models in ACL2 are made to execute fast [19]. The model there executes at approximately 3 million simulated instructions per second on a 728 MH... |

23 | The apprentice challenge
- Moore, Porter
- 2002
(Show Context)
Citation Context ...g system kernel, a program involving approximately 20 classes, 6 threads, 91 methods, 41 instance fields, and 51 static fields. The property was a complex time-partitioning requirement. See our paper =-=[35]-=- for a discussion of the use of JPF to check a theorem also proved by ACL2. There are other theorem-proving based approaches to Java verification. One such tool is the LOOP tool [2, 43] which translat... |

20 | A Type-Theoretic Memory Model for Verification of Sequential Java Programs
- Berg, Huisman, et al.
- 1999
(Show Context)
Citation Context ...le, just before a thread executes the MONITORENTER, the object on top of the stack must be the container. Once we have defined good-state we prove four lemmas. (defthm [1] (good-state *a0*) ) (defthm =-=[2]-=- (implies (good-state s) (good-state (step th s))) ) (defthm [3] (implies (good-state s) (implies (not (equal (counter s) nil)) (or (equal (counter s) (counter (step th s))) (equal (int-fix (+ 1 (coun... |

19 |
A computational logic handbook. Second edition
- Boyer, Moore
- 1998
(Show Context)
Citation Context ...dard. We model the JVM in ACL2, A Computational Logic for Applicative Common Lisp, by Matt Kaufmann and J Moore. ACL2 [25] is the industrial-strength successor to the BoyerMoore theorem prover, Nqthm =-=[6]-=-. ACL2 is a first-order applicative programming language based on Common Lisp. It is also a mathematical logic for which a mechanical theoremprover has been implemented in the style of Nqthm. Our JVM ... |

17 | Proving Theorems about Java-like Byte Code
- Moore
- 1999
(Show Context)
Citation Context ...e objects, method resolution and invocation, and threads. The machine described here is named M5 and is the last machine in the series above. A sequential predecessor of M5, named M3, is discussed in =-=[33]-=-, including how we use ACL2 to prove theorems about sequential bytecode programs. (M4 was a multi-threaded version that supported only a few bytecodes.) That paper briefly presents some of the ideas d... |

16 |
W.D.: Special issue on system verification
- Bevier, Hunt, et al.
- 1989
(Show Context)
Citation Context ...ls and their interpretation of programs. During the 1980s and 1990s the Boyer-Moore community modeled several microprocessors and other computing machines and developed techniques for managing proofs =-=[22, 3, 46, 4, 23, 7, 45, 9]-=-. The techniques are described in [5]. A good example of the application of these techniques to another commercial language is provided by Yu’s work [7] in which 21 of the 22 Berkeley C String Library... |

14 | A mechanically checked proof of a multiprocessor result via a uniprocessor view. http://www.cs.utexas.edu/users/moore/publications/acl2-papers.html
- Moore
- 1998
(Show Context)
Citation Context ...al analysis of multi-threaded code. In addition, our schedules (and the analogous “clock functions” we use in single-threaded models) allow us to structure inductive proofs. Finally, work reported in =-=[32]-=- suggests a way we might approach the verification of multithreaded code by lifting the view of the system to a single-threaded machine in which “spontaneous” changes are visited upon the shared resou... |

13 |
version of the consistency proof for elementary number theory
- Gentzen
- 1938
(Show Context)
Citation Context ...ot (symbolp x))) nil is a theorem, which is provably equivalent to the axiom (consp x) t (symbolp x) nil. We tend henceforth to exhibit all of our theorems as terms. 2.5 Definitions Following Gentzen =-=[15]-=-, we embed the ordinals up to into our universe by defining a function that recognizes when certain lists and numbers represent ordinals. For example, the list (4 2 2 2 . 7) represents the ordinal . W... |

13 | Linking theorem proving and model-checking with well-founded bisimulation
- Manolios, Namjoshi, et al.
- 1999
(Show Context)
Citation Context ...y are essentially lifting a proof done earlier by Rob Sumners (ECE Department and AMD) and Ray on the in situ quicksort algorithm [42]. Rob Sumners is also using methods similar to those described in =-=[29]-=- to obtain a progress property for the Apprentice system based on the invariant proved. In [28] we describe a method for introducing tail-recursive functions that do not necessarily terminate. Such fu... |

12 |
The defensive Java virtual machine specification version 0.5
- Cohen
- 1997
(Show Context)
Citation Context ...perationally has a long tradition. McCarthy [31] said “The meaning of a program is defined by its effect on the state vector.” The first mechanized formal model of the JVM was Cohen’s “defensive JVM” =-=[10]-=- in ACL2. Cohen’s machine includes type tags on all data objects so that type errors can be detected and signaled at runtime. It was designed for use in verifying the bytecode verifier. Cohen’s machin... |

9 |
de Sousa. A formal executable semantics of the JavaCard platform
- Barthe, Dufay, et al.
- 2001
(Show Context)
Citation Context ...igher order logic. As such, LOOP can be used as a front end for such theorem provers as PVS [37] and Isabelle [36]. However, LOOP currently deals only with sequential Java. Other related work include =-=[38, 1]-=-, where models of the JVM are formalized in Isabelle and Coq [12]. In both efforts, the correctness of the bytecode verifier is addressed and the JVM models are largely concerned with type correctness... |

7 |
Formal analysis of the motorola CAP DSP
- Brock, Hunt
- 1999
(Show Context)
Citation Context |

7 |
Stack-based Java a back-to-future step. Electronic Engineering Times
- Greve, Wilding
- 1998
(Show Context)
Citation Context ... which Rockwell engineers tested the chip design against the requirements by executing compiled Java programs. The ACL2 model executed at approximately 90% of the speed of the previously used C model =-=[20, 21]-=-. Greve, Wilding, and Hardin describe how microprocessor models in ACL2 are made to execute fast [19]. The model there executes at approximately 3 million simulated instructions per second on a 728 MH... |

4 | Evaluatable, high-assurance microprocessors
- Greve, Wilding
- 2002
(Show Context)
Citation Context ... a 728 MHZ Pentium III host running Allegro Common Lisp. At Rockwell not only are ACL2 models used for simulation purposes but microarchitectural models are related to one another by ACL2 proofs. See =-=[18]-=-. Similar work is being conducted at Advanced Micro Devices. For example, an executable ACL2 model of the RTL for the AMD Athlon floating-point square root was tested on 80 million floating-point vect... |

4 |
FM8501: A Verified Microprocessor. Springer-Verlag LNAI 795
- Hunt
- 1994
(Show Context)
Citation Context |

1 |
Taylor’s theorem with remainder
- Gamboa, Middleton
- 2002
(Show Context)
Citation Context ...e and inaccurate. We are working on improving the accuracy of our model. The current model omits support for floating point data. ACL2 has been used extensively to do floating-point verification work =-=[14, 41, 40, 39, 34]-=- and adding floating-point to our JVM model would not be difficult. The current model omits support for syntactic typing but we currently have a prototype model that addresses this problem. In the mod... |