Towards feasible, machine-assisted verification of object-oriented programs

This thesis provides an account of a development of tools towards making verification of object-oriented programs more feasible. We note that proofs in program verification logics are typically long, yet, mathematically, not very deep; these observations suggest the thesis that computers can significantly ease the burden of program verification. We give evidence supporting this by applying computers to (1) automatically check and (2) automatically infer large parts of proofs. Taking the logic (AL) of Abadi and Leino as our starting point, we initially show how the logic can be embedded into a higher-order logic theorem prover, by way of introducing axioms, using a mix of both higher-order abstract syntax (HOAS) and a direct embedding of the assertion logic. The tenacity and exactness of the theorem prover ensures that no proof obligation is inadvertently lost during construction of a proof; we inherit any automatic facilities such as tactics which take us part way towards goal (2); and moreover, we achieve goal (1), since we inherit machine proofs which can be checked automatically. We present some extended examples in AL that have been proved using this embedding. Since we use a mix of HOAS and the underlying logic, justification of the axioms is no longer trivial. In particular, because we use a HOAS-style encoding of the program syntax, using a standard interpretation, the set of programs does not correspond to that defined using the first-order syntax. Thus, we construct a non-standard model of higher-order logic using categorical constructs, and show, in this interpretation (i.e. model), that the axioms are sound. Further towards goal (2), we consider a verification condition generator (VCG) algorithm which automatically infers large parts of a proof. The VCG takes, as input, a program c—possibly with annotations—and a specification S, and outputs a logical sentence called a verification condition (VC). The intention is that to prove c satisfies S, it suffices to prove the VC; or equivalently, the VCG automatically proves c satisfies S, modulo validity of the VC. The VC resulting from the algorithm is, in general, a first-order formula with fix-points. In particular cases, it is known that there exist brute force checking algorithms for such formulae which are much more efficient than those for checking