Verifying finite-state properties of large-scale programs

Designers of software components can use finite-state properties to denote behavioral interface specifications which enforce client-side programming rules that state how the components ought to be used. This allows users of these components to check their client code for compliance with these rules, both statically and at runtime. In this dissertation we explain the design and implementation of C LARA, a framework for specifying and verifying finite-state properties of large-scale programs. With CLARA, programmers specify finite-state properties together with runtime monitors, using a syntactic extension to the aspect-oriented programming language AspectJ. CLARA then uses a sequence of three increasingly detailed static analyses to determine if the program satisfies the finite-state properties, i.e., is free of property violations. CLARA produces a list of program points at which the program may violate the properties, ranked by a confidence value. If violations are possible, CLARA also instruments the program with the supplied runtime monitor, which will capture property violations when the program executes. Due to its static analyses, CLARA can omit the instrumentation at program locations which the analyses proved safe, and so optimize the instrumented program. When much instrumentation remains, CLARA partitions the instrumentation into subsets, so that one can distribute multiple partially instrumented program versions that each run with a low overhead. We validated the approach by applying CLARA to finite-state properties denoted in multiple formalisms over several large-scale Java programs. CLARA proved that most of the programs fulfill our example properties. For most other programs, CLARA could remove the monitoring overhead to below 10%. We also found multiple property violations by manually inspecting the top entries in CLARA's ranked result list.