Program analysis utilizes static techniques for computing reliable information about the dynamic behavior of programs. Applications include compilers (for code improvement), software validation (for detecting errors) and transformations between data representation (for solving problems such as Y2K). This book is unique in providing an overview of the four major approaches to program analysis: data flow analysis, constraint-based analysis, abstract interpretation, and type and effect systems. The presentation illustrates the extensive similarities between the approaches, helping readers to choose the best one to utilize.

Principles of program analysis

This paper defines techniques for the slicing of UML models, that is, for the restriction of models to those parts which specify the properties of a subset of the elements within them. The purpose of this restriction is to produce a smaller model which permits more effective analysis and comprehension than the complete model, and also to form a step in factoring of a model. We consider class diagrams, individual state machines, and communicating sets of state machines.

Slicing of UML models using model transformations

JML is a behavioral interface specification language tailored to Java(TM). Besides pre- and postconditions, it also allows assertions to be intermixed with Java code; these aid verification and debugging. JML is designed to be used by working software engineers; to do this it follows Eiffel in using Java expressions in assertions. JML combines this idea from Eiffel with the model-based approach to specifications, typified by VDM and Larch, which results in greater expressiveness. Other expressiveness advantages over Eiffel include quantifiers, specification-only variables, and frame conditions.This paper discusses the goals of JML, the overall approach, and describes the basic features of the language through examples. It is intended for readers who have some familiarity with both Java and behavioral specification using pre- and postconditions.

/pdf/preliminary-design-of-jml-a-behavioral-interface-24ocjzm1mg.pdf

Preliminary design of JML: a behavioral interface specification language for java

JML is a behavioral interface speci cation language tailored to Java It also allows assertions to be intermixed with Java code, as an aid to veri cation and debugging JML is designed to be used by working software engineers, and requires only modest mathematical training To achieve this goal, JML uses Ei el-style assertion syntax combined with the model-based approach to speci cations typi ed by VDM and Larch However, JML supports quanti ers, speci cation-only variables, frame conditions, and other enhancements that make it more expressive for speci cation than Ei el This paper discusses the goals of JML, the overall approach, and describes the language through examples It is intended for readers who have some familiarity with both Java and behavioral speci cation using preand postconditions

https://lib.dr.iastate.edu/cgi/viewcontent.cgi?article=1123&context=cs_techreports

Preliminary Design of JML: A Behavioral Interface Specification

This paper presents a static race detection analysis for multithreaded Java programs. Our analysis is based on a formal type system that is capable of capturing many common synchronization patterns. These patterns include classes with internal synchronization, classes thatrequire client-side synchronization, and thread-local classes. Experience checking over 40,000 lines of Java code with the type system demonstrates that it is an effective approach for eliminating races conditions. On large examples, fewer than 20 additional type annotations per 1000 lines of code were required by the type checker, and we found a number of races in the standard Java libraries and other test programs.

/pdf/type-based-race-detection-for-java-5bk8xwq686.pdf

Type-based race detection for Java

This paper specifies, via a Hoare-like logic, an interprocedural and flow sensitive (but termination insensitive) information flow analysis for object-oriented programs. Pointer aliasing is ubiquitous in such programs, and can potentially leak confidential information. Thus the logic employs independence assertions to describe the noninterference property that formalizes confidentiality, and employs region assertions to describe possible aliasing. Programmer assertions, in the style of JML, are also allowed, thereby permitting a more fine-grained specification of information flow policy.The logic supports local reasoning about state in the style of separation logic. Small specifications are used; they mention only the variables and addresses relevant to a command. Specifications are combined using a frame rule. An algorithm for the computation of postconditions is described: under certain assumptions, there exists a strongest postcondition which the algorithm computes.

/pdf/a-logic-for-information-flow-in-object-oriented-programs-1q11x8utlz.pdf

A logic for information flow in object-oriented programs

We specify an information flow analysis for a simple imperative language, using a Hoare-like logic. The logic facilitates static checking of a larger class of programs than can be checked by extant type-based approaches in which a program is deemed insecure when it contains an insecure subprogram. The logic is based on an abstract interpretation of program traces that makes independence between program variables explicit. Unlike other, more precise, approaches based on a Hoare-like logic, our approach does not require a theorem prover to generate invariants. We demonstrate the modularity of our approach by showing that a frame rule holds in our logic. Moreover, given an insecure but terminating program, we show how strongest postconditions can be employed to statically generate failure explanations.

/pdf/information-flow-analysis-in-logical-form-4ifyubefv1.pdf

Information Flow Analysis in Logical Form

The notion of control dependence underlies many program analysis and transformation techniques. Despite being widely used, existing definitions and approaches to calculating control dependence are difficult to apply directly to modern program structures because these make substantial use of exception processing and increasingly support reactive systems designed to run indefinitely.This article revisits foundational issues surrounding control dependence, and develops definitions and algorithms for computing several variations of control dependence that can be directly applied to modern program structures. To provide a foundation for slicing reactive systems, the article proposes a notion of slicing correctness based on weak bisimulation, and proves that some of these new definitions of control dependence generate slices that conform to this notion of correctness. This new framework of control dependence definitions, with corresponding correctness results, is even able to support programs with irreducible control flow graphs. Finally, a variety of properties show that the new definitions conservatively extend classic definitions. These new definitions and algorithms form the basis of the Indus Java slicer, a publicly available program slicer that has been implemented for full Java.

/pdf/a-new-foundation-for-control-dependence-and-slicing-for-3wwrjiuvo5.pdf

A new foundation for control dependence and slicing for modern program structures

The type and effect system the semantics the inference algorithm the inference algorithm - completeness post-processing the analysis a case study.

Type and Effect Systems: Behaviours for Concurrency

The notion of control dependence underlies many program analysis and transformation techniques. Despite wide applications, existing definitions and approaches for calculating control dependence are difficult to apply seamlessly to modern program structures. Such program structures make substantial use of exception processing and increasingly support reactive systems designed to run indefinitely.

This paper revisits foundational issues surrounding control dependence and slicing. It develops definitions and algorithms for computing control dependence that can be directly applied to modern program structures. A variety of properties show that the new definitions conservatively extend classic definitions. In the context of slicing reactive systems, the paper proposes a notion of slicing correctness based on weak bisimulation and proves that the definition of control dependence generates slices that conform to this notion of correctness. The new definitions and algorithms for control dependence form the basis of a publicly available program slicer that has been implemented for full Java.

/pdf/a-new-foundation-for-control-dependence-and-slicing-for-53prc033j0.pdf

Torben Amtoft

Papers

A logic for information flow in object-oriented programs

Information Flow Analysis in Logical Form

A new foundation for control dependence and slicing for modern program structures

Type and Effect Systems: Behaviours for Concurrency

A new foundation for control-dependence and slicing for modern program structures