A Statically Verifiable Programming Model for Concurrent Object-Oriented Programs

  • Bart Jacobs
  • Jan Smans
  • Frank Piessens
  • Wolfram Schulte
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4260)


Reasoning about multithreaded object-oriented programs is difficult, due to the non-local nature of object aliasing, data races, and deadlocks. We propose a programming model that prevents data races and deadlocks, and supports local reasoning in the presence of object aliasing and concurrency. Our programming model builds on the multi-threading and synchronization primitives as they are present in current mainstream languages. Java or C# programs developed according to our model can be annotated by means of stylized comments to make the use of the model explicit. We show that such annotated programs can be formally verified to comply with the programming model. In other words, if the annotated program verifies, the underlying Java or C# program is guaranteed to be free from data races and deadlocks, and it is sound to reason locally about program behavior. We have implemented a verifier for programs developed according to our model in a custom build of the Spec# programming system, and have validated our approach on a case study.


Proof Obligation Shared Object Multiple Thread Data Race Deadlock Prevention 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Detlefs, D.L., Leino, K.R.M., Nelson, G., Saxe, J.B.: Extended static checking. Research Report 159, Compaq Systems Research Center (1998)Google Scholar
  2. 2.
    Flanagan, C., Leino, K.R.M., Lillibridge, M., Nelson, G., Saxe, J.B., Stata, R.: Extended static checking for Java. In: PLDI 2002. SIGPLAN Notices, vol. 37, pp. 234–245. ACM Press, New York (2002)CrossRefGoogle Scholar
  3. 3.
    Freund, S.N., Qadeer, S.: Checking concise specifications for multithreaded software. Journal of Object Technology 3(6), 81–101 (2004)CrossRefGoogle Scholar
  4. 4.
    Qadeer, S., Rajamani, S.K., Rehof, J.: Summarizing procedures in concurrent programs. In: POPL 2004. SIGPLAN Notices, vol. 39, pp. 245–255. ACM Press, New York (2004)CrossRefGoogle Scholar
  5. 5.
    Ábrahám-Mumm, E., de Boer, F.S., de Roever, W.P., Steffen, M.: Verification for Java’s reentrant multithreading concept. In: Nielsen, M., Engberg, U. (eds.) FOSSACS 2002. LNCS, vol. 2303, pp. 5–20. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  6. 6.
    Rodríguez, E., Dwyer, M., Flanagan, C., Hatcliff, J., Leavens, G.T.: Extending sequential specification techniques for modular specification and verification of multi-threaded programs. In: Black, A.P. (ed.) ECOOP 2005. LNCS, vol. 3586, pp. 551–576. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  7. 7.
    Boyapati, C., Lee, R., Rinard, M.: Ownership types for safe programming: Preventing data races and deadlocks. In: OOPSLA 2002. SIGPLAN Notices, vol. 37, pp. 211–230. ACM, New York (2002)CrossRefGoogle Scholar
  8. 8.
    Flanagan, C., Qadeer, S.: A type and effect system for atomicity. In: PLDI 2003, pp. 338–349. ACM, New York (2003)CrossRefGoogle Scholar
  9. 9.
    Barnett, M., Leino, K.R.M., Schulte, W.: The Spec# programming system: An overview. In: Barthe, G., Burdy, L., Huisman, M., Lanet, J.-L., Muntean, T. (eds.) CASSIS 2004. LNCS, vol. 3362, pp. 49–69. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  10. 10.
    Barnett, M., Chang, B.Y.E., DeLine, R., Jacobs, B., Leino, K.R.M.: Boogie: A modular reusable verifier for object-oriented programs. In: de Boer, F.S., Bonsangue, M.M., Graf, S., de Roever, W.-P. (eds.) FMCO 2005. LNCS, vol. 4111, pp. 364–387. Springer, Heidelberg (to appear, 2006)CrossRefGoogle Scholar
  11. 11.
    Jacobs, B., Leino, K.R.M., Piessens, F., Schulte, W.: Safe concurrency for aggregate objects with invariants. In: Proc. Int. Conf. Software Engineering and Formal Methods (SEFM 2005), pp. 137–146. IEEE Computer Society, Los Alamitos (2005)CrossRefGoogle Scholar
  12. 12.
    Barnett, M., DeLine, R., Fähndrich, M., Leino, K.R.M., Schulte, W.: Verification of object-oriented programs with invariants. Journal of Object Technology 3(6), 27–56 (2004)CrossRefGoogle Scholar
  13. 13.
    Flanagan, C., Freund, S.N.: Atomizer: A dynamic atomicity checker for multithreaded programs. In: POPL 2004. SIGPLAN Notices, vol. 39, pp. 256–267. ACM, New York (2004)CrossRefGoogle Scholar
  14. 14.
    Hoare, C.A.R.: Monitors: An operating system structuring concept. Communications of the ACM 17(10), 549–557 (1974)zbMATHCrossRefGoogle Scholar
  15. 15.
    Savage, S., Burrows, M., Nelson, G., Sobalvarro, P., Anderson, T.E.: Eraser: A dynamic data race detector for multi-threaded programs. ACM Transactions on Computer Systems 15(4), 391–411 (1997)CrossRefGoogle Scholar
  16. 16.
    Welc, A., Jagannathan, S., Hosking, A.L.: Transactional monitors for concurrent objects. In: Odersky, M. (ed.) ECOOP 2004. LNCS, vol. 3086, pp. 518–541. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  17. 17.
    Jacobs, B., Leino, K.R.M., Piessens, F., Schulte, W.: Safe concurrency for aggregate objects with invariants: Soundness proof. Technical Report MSR-TR-2005-85, Microsoft Research (2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Bart Jacobs
    • 1
  • Jan Smans
    • 1
  • Frank Piessens
    • 1
  • Wolfram Schulte
    • 2
  1. 1.DistriNet, Dept. Computer ScienceK.U. LeuvenLeuvenBelgium
  2. 2.Microsoft ResearchRedmondUSA

Personalised recommendations