Modular Generic Verification of LTL Properties for Aspects

Transcription

1 Modulr Generic Verifiction of LTL Properties for Aspects Mx Goldmn Shmuel Ktz Computer Science Deprtment Technion Isrel Institute of Technology {mgoldmn, ABSTRACT Aspects re seprte code modules tht cn e ound ( woven ) to se progrm t joinpoints to provide n ugmented progrm. A novel pproch is defined to verify tht n spect stte mchine will provide desired properties whenever it is woven over se stte mchine tht stisfies the ssumptions of the spect. A single stte mchine is constructed using the tleu of the liner temporl logic (LTL) description of the ssumptions, description of the joinpoints, nd the stte mchine of the spect code. A theorem is shown tht if the constructed mchine stisfies the desired properties, so will n ugmented stte mchine using ny se mchine tht stisfies the ssumptions. The theorem is stted nd shown for ssumptions nd properties given in LTL, for somewht restricted form of joinpoint description, nd for spect code tht ends in sttes lredy rechle in the se stte mchine. A lnguge-sed description of spects, s in AspectJ, cn e converted to stte mchine version using existing tools, thus providing generic modulr verifiction of code-level spects. 1. INTRODUCTION 1.1 Aspect-Oriented Progrmming The spect-oriented pproch to softwre development is one in which concerns tht cut cross mny prts of the system re encpsulted in seprte modules clled spects. For exmple, when security or logging re encpsulted in n spect, this spect contins oth the code ssocited with the concern, clled dvice, nd description of when this dvice should run, clled pointcut descriptor. The pointcut descriptor identifies those points in the execution of progrm t which the dvice should e invoked. The comintion of some se progrm with n spect (or in generl, collection of spects), is termed n ugmented progrm. 1.2 Forml Verifiction In this work we re concerned with generic forml verifiction of spects reltive to specifiction. The specifiction of n spect consists of ssumptions out ny se progrm to which the spect cn resonly e woven, nd desired properties intended to hold for the ugmented progrm. We view oth se progrms nd spect code s nondeterministic finite stte mchines, in which prticulr computtions re relized s infinite sequences of sttes within the mchine. For oth ssumptions nd desired properties to e verified we consider formuls written in liner temporl logic (LTL). An LTL formul consists of pth formul using temporl quntifiers nd logicl comintions of tomic propositions, prefixed y single (usully implicit) universl pth quntifier. The tomic propositions in formul refer to the lels of sttes in finite stte mchine; temporl quntifiers specify when these ssertions out sttes must e true. The universl pth quntifier requires tht, in order for some initil stte to stisfy n LTL ssertion, ll infinite pths from tht stte must stisfy the pth formul. In generl, stte mchine lso includes firness constrint, nd only fir pths re considered. 1.3 Modulr Aspectul Verifiction It is cler tht given se progrm, collection of spects with their pointcut descriptors nd dvice, nd system for weving together these components to produce stnd-lone ugmented progrm, we cn verify properties of this ugmented system using the usul model checking techniques. Such weving involves dding edges from joinpoint sttes of the se progrm to the initil sttes of the dvice, nd from the sttes fter n dvice segment to sttes where se progrm sttements re executed. It would e preferle, however, if we could employ modulr technique in which the spect cn e considered seprtely from the se progrm. This would llow us to: otin verifiction results tht hold for prticulr spect with ny se progrm from some clss of progrms, rther thn for only one se progrm in prticulr; use the results to reson out the ppliction of spects to se progrms with multiple evolving stte mchines descriing chnging configurtions during execution, or to other se systems not menle to model checking; nd void model checking ugmented systems, which my e significntly lrger thn their se systems, nd whose unknown ehvior my resist strction.

2 The second point ove reltes to generl oject-oriented progrms tht crete new instnces of clsses (ojects) with ssocited stte mchine components. Often, the ssumption of n spect out the key properties of those se stte mchines to which it my e woven cn indeed e shown to hold for every possile mchine tht corresponds to n oject configurtion of progrm. For exmple, it my involve so-clled clss invrint, provle y resoning directly on clss declrtions, s in [1]. This point nd more detils on the connections etween code-sed spects (s in AspectJ) nd the stte mchine versions seen here re discussed in Section 5. This prolem of creting single generic model tht cn represent ny possile ugmented progrm for n spect woven over some clss of se progrms is especilly difficult ecuse of the spect-oriented notion of oliviousness: se progrms re generlly unwre of spects dvising them, nd hve no control over when or how they re dvised. There re no explicit mrkers for the trnsfer of control from se to dvice code, nor re there gurntees out if or where dvice will return control to the se progrm. 1.4 Results In this pper we show how to verify once-nd-for-ll tht for ny se stte mchine stisfying the ssumptions of the spect, nd for weving tht dds the spect dvice s indicted in the joinpoint description, the resulting ugmented stte mchine is gurnteed to stisfy the desired properties given in the specifiction. A single generic stte mchine is constructed from the tleu of the ssumption, the pointcut descriptor, nd the dvice stte mchine, nd verified for the desired property. Then, when prticulr se progrm is to e woven with the spect, it is sufficient to estlish tht the se stte mchine stisfies the ssumption. Thus the entire ugmented progrm never hs to e model checked, chieving true modulrity nd genericity in the proof. This pproch is especilly pproprite for spects intended to e reused over mny se progrms, e.g., those in lirries or middlewre components. LTL model checking is sed on creting tleu stte mchine utomton tht ccepts exctly those computtions tht stisfy the property to e verified. Usully, the negtion of this mchine is then composed s cross-product with the model to e checked. A counter-exmple is produced when the composed system contins some infinite pth, nd the property is stisfied for the model when the cross-product hs no such pths. Here we use the tleu of the ssumption in unique wy, s the sis of the generic model to e checked for the desired property. It represents ny se mchine stisfying the ssumption, ecuse the execution sequences of the se progrm cn e strcted y sequences in the tleu. For the soundness theorem presented in Section 4, the spects treted re ssumed to e wekly invsive, s defined in [7]. This mens tht when dvice hs completed executing, the system continues from stte tht ws lredy rechle in the originl se progrm (perhps for different inputs or ctions of the environment). Mny spects fll into this ctegory, including specttive spects tht never modify the stte of the se system (logging is good exmple), nd regultive spects tht only restrict the rechle stte spce (for exmple, spects implementing security checks). Also wekly invsive would e n spect to enforce trnsctionl requirements, which might roll ck series of chnges so tht the system returns to the stte it ws in efore they were mde. Even discount policy spect tht reduces the price on certin items in retil system is wekly invsive, since the originl price given s input could hve een the discounted one. Additionlly, we ssume tht ny executions of n ugmented progrm tht infinitely often include sttes resulting from spect dvice will e fir (nd thus must e considered for correctness purposes). The version here does not tret multiple spects or joinpoints influenced y the introduction of dvice, lthough the pproch cn e expnded to tret such cses s well. In the following section, needed terms nd constructs re defined. Section 3 presents the lgorithm, nd Section 4 gives proof of soundness in the wekly invsive spect cse. This section lso gives n exmple. Section 5 detils works relted to the result here, nd is followed y the conclusion. 2. DEFINITIONS 2.1 LTL Tleux Intuitively, the tleu of n LTL foruml f is stte mchine whose fir infinite pths re exctly ll those pths which stisfy the formul f. This intuition will e relized formlly in Theorem 1 elow. In the context of performing model checking to verify stisfction of n LTL property, tleu is constructed for the negtion of tht property, in order to cpture ll possile computtions tht would cuse mchine not to stisfy the formul in question. It is importnt to stress tht here we use the tleu for the originl non-negted formul. Nevertheless, ecuse of the use of tleux y LTL model checking tools, modules to perform the construction of formul s tleu re ville. For explortory purposes, the uthors hve used the trnsltor module of NuSMV [10], which produces (tleu) finite stte mchine from given LTL formul. We define T f, the tleu for LTL pth formul f, s given in Model Checking [3] in the section on Symolic LTL Model Checking (6.7). In this construction, the originl formul is decomposed into the set of elementry formuls it contins, where ll other temporl opertors, such s from now on (G) nd eventully (F), re expressed in terms of next (X) nd strong until (U). Ech stte in the tleu is suset of these elementry formuls, nd the pth reltion etween these sttes is defined y mens of function st(g), which cptures the set of sttes in which suformul g of f is stisfied. We denote T f = (S T, S0 T, R T, L T, F T ), where S T is the set of sttes; S0 T is the set of initil sttes, R T is the trnsition reltion, L T is the leling function, nd F T is the set of fir stte sets. For ese of discussion, we clrify the definition s follows:

3 Define S T 0, where for χ = Af, we hve T f = χ: S T 0 = st(f) Define F T, where ny fir pth in T f must visit ech set in F T infinitely mny times: F T = {st(( (g U h)) h) g U h is suformul of f} This firness constrint gurntees tht oligtions of the form g U h re fulfilled, either y visiting stte in st(h) infinitely often, or y infinitely often visiting stte outside of st(g U h), which cn only e reched y going vi st(h) ccording to the construction of the pth reltion (not detiled here). Two notle properties of T f will e used elow. First, if AP f is the set of tomic propositions in f, then L T : S P(AP f ) tht is, the lels of the sttes in the tleu will include sets of the tomic propositions ppering in f. A stte in ny mchine is given prticulr lel if nd only if tht tomic proposition is true in tht stte. The second interesting feture is min theorem from the discussion in [3]: Definition 1. For pth π, let lel(π) e the sequence of lels (susets of AP ) of the sttes of π. For such sequence l = l 0, l 1,... nd set Q, let l Q = m 0, m 1,... where for ech i 0, m i = l i Q. Definition 2. Sret A is the set of return sttes of A, where Sret A S A nd for ny stte s Sret, A s hs no outgoing edges. 2.3 Pointcuts We do not give prescriptive definition for pointcut descriptors here; in prctice pointcut descriptions might tke numer of forms. However, we require tht descriptors operte in the following mnner: Definition 3. Given pointcut descriptor ρ over tomic propositions AP nd finite sequence l of lels (susets of AP ), we cn sk whether or not the end of l is mtched y ρ, written l ρ. A resonle choice for descriing pointcuts might e LTL pth formuls contining only pst temporl opertors. For exmple, the descriptor ρ 1 = Y Y Y would mtch sequences ending with stte where is true, preceded y, preceded y nother (opertor Y is the pst nlogue of X). Other lnguges could e imgined, for exmple regulr expressions, where ρ 2 = true might e equivlent to ρ 1. The use of regulr expressions over utomt is populr in industril specifiction lnguges nd hs een exmined in forml comintion with LTL for exmple in [2]. 2.4 Specifictions In ddition to its dvice, in the form of stte mchine A, nd pointcut, descried y ρ, n spect is considered to hve two pieces of forml specifiction: Theorem 1. Given T f, for ny Kripke structure M, for ll fir pths π in M, if M, π = f then there exists fir pth π in T f such tht π strts in S0 T nd lel(π ) APf = lel(π). Tht is, for ny possile computtion of M stisfying formul f, there is pth in the tleu of f which mtches the lels within AP f long the sttes of tht computtion. In the lgorithm of Section 3, we restrict the tleu to its rechle component. Such restriction does not ffect the result of this theorem, since ll rechle pths re preserved, ut is necessry in order to chieve useful results. This follows from the oservtion tht the tleu for the negtion of formul hs precisely the sme sttes nd trnsition reltion, ut the complementry set of initil sttes. Thus, ny unrechle portion of the tleu is lile to contin exctly those ehviors which violte the formul of interest. Finlly, for χ = Af, define T χ = T f s convenient nottion ( tleu cn only e constructed for pth formul). 2.2 Aspects An spect mchine A = (S A, S A 0, S A ret, R A, L A) over tomic propositions AP is defined s usul for mchine with no firness constrint, with the following ddition: Formul ψ expresses the ssumptions mde y the spect out ny se mchine to which it will e woven. This ψ is thus requirement to e met y ny such mchine. Formul φ expresses the desired result to e stisfied y ny ugmented mchine uilt y weving this spect with conforming se mchine. In other words, φ is the gurntee of the spect. 2.5 Weving Weving is the process of comining se mchine with some spect ccording to prticulr pointcut descriptor; the result is n ugmented mchine tht includes the dvice of the spect. The weving lgorithm hs the following inputs: spect mchine A = (S A, S A 0, S A ret, R A, L A) over AP, pointcut ρ over AP, nd se mchine B = (S B, S B 0, R B, L B, F B) over AP B AP. And it produces s output: ugmented mchine e B = (S eb, S e B 0, R eb, L eb, F eb ).

4 The weving is performed in two steps. First we construct from the se mchine B new stte mchine B ρ which is pointcut-redy for ρ, wherein ech stte either definitely is or is not mtched y ρ. Then we use B ρ nd A to uild the finl ugmented mchine e B. M M ρ This two-step division of the weving process mens tht the lgorithm cnnot hndle numer of prolemtic cses: when the pointcut descriptor mtches dvice sttes, nd thus dvice should e inserted on other dvice; when the ddition of dvice sttes cretes new mtching pointcut in the computtion, nd dvice should e inserted; nd when the ddition of dvice sttes cuses loction tht once mtched pointcut selector not to mtch it ny longer. Proper hndling of these scenrios is the suject of ongoing work Constructing Pointcut-Redy Mchine Pointcut-redy mchine B ρ = (S B ρ, S0 Bρ, R B ρ, L B ρ, F B ρ) is mchine in which unwinding of certin pths hs een performed, so tht we cn seprte pths which mtch pointcut descriptor ρ from those tht do not. The pointcut-redy mchine contins sttes with new lel, pointcut, tht indictes exctly those sttes where the descriptor hs een mtched. This mchine must meet the following requirements: S B ρ S B S Bρ 0 = S B 0 pointcut Figure 1: Constructing pointcut-redy mchine M ρ for the given M nd LTL pst formul pointcut descriptor ρ = Y Y Y. (s, t) R eb 8 (s, t) R B ρ s = pointcut if s, t S B ρ >< (s, t) R A if s, t S A s = pointcut t S0 A L B ρ(s) AP = L A(t) if s S B ρ, t S A >: s Sret A L A(s) = L B ρ(t) AP if s S A, t S B ρ Note tht this reltionship is if nd only if. In words, the pth reltion contins precisely ll the edges from the pointcut-redy se mchine B ρ nd from spect mchine A, except tht pointcut sttes in B ρ hve edges only to mtching strt sttes in A, nd spect return sttes hve edges to ll mtching se sttes. L B ρ is function from S B ρ to P (AP B {pointcut}) For ll finite-length pths π = s 0,..., s k in B ρ such tht s 0 S0 Bρ, lel(π) ρ s k = pointcut. j LB ρ(s) L eb (s) = L A(s) F eb = F B ρ S A if s S B ρ if s S A For ll infinite sequences of lels l = (P(AP B)) ω, there is fir pth π B ρ in B ρ where lel(π B ρ) APB = l if nd only if there is fir pth π B in B where lel(π B) = l. Note tht since B nd B ρ hve the sme pths (over AP, ignoring the dded pointcut lel), they must stisfy exctly the sme LTL formuls over AP. Figure 1 shows simple exmple of this construction. Note tht in stte digrms, the sence of n tomic proposition indictes tht the proposition does not hold, not tht the vlue is unknown or irrelevnt. This is in contrst to formul, where unmentioned propositions re not restricted Constructing n Augmented Mchine We construct the components of ugmented mchine e B = (S eb, S e B 0, R eb, L eb, F eb ) s follows: S eb = S B ρ S A S e B 0 = S Bρ 0 Tht is, F eb = {F i S A F i F B ρ}. A pth is fir if it either stisfies the firness constrint of the pointcut-redy mchine, or if it visits some spect stte infinitely mny times conservtively inclusive definition. A weving is considered successful if every rechle node in S eb hs successor ccording to R eb. 2.6 Wekly Invsive Aspects As mentioned ove, we show our result for the rod clss of spects which, when they return from dvice, do so to rechle stte in the se mchine. Without this restriction, the spect my return to unrechle prts of the se mchine whose ehvior is not ound y ssumption formul ψ. In this cse, the ugmented system contins portions with unknown ehvior, nd is difficult to reson out in modulr wy. Definition 4. An spect A nd pointcut ρ re sid to e wekly invsive for se mchine B if, for ll sttes in S B ρ tht re rechle y fir pth in e B, those sttes were rechle y fir pth in B ρ.

5 π sk Bse Mchine π t1 π tl π M pc s 0 s 1 s k 1 s k t 1 t l Aspect Mchine s k+1 Figure 2: Using fir pths in M (smll sttes long the top) to gurntee mtching pth in f T ψ. In prticulr, this mens tht ll sttes to which the spect returns re sttes rechle in the pointcut-redy se mchine. This could of course e checked directly, ut would require construction of the ugmented mchine precisely the opertion we would like to void. In mny cses, the spect cn e shown wekly invsive for ny se mchine stisfying its ssumption ψ, y using sttic nlysis, locl model checking, or dditionl informtion (our resoning in the discount price exmple from Section 1.4 uses such informtion). For further discussion, see [7]. 3. ALGORITHM The lgorithm uilds tleu from ψ nd weves A with this tleu ccording to ρ, then performs model checking to verify the result with respect to φ. In the following section we prove tht when this model check of the constructed ugmented tleu succeeds, then for ny se system stisfying requirement ψ, pplying spect A ccording to pointcut descriptor ρ will yield n ugmented system stisfying result φ. Given: set of tomic propositions AP ; ssumption ψ for se systems, n LTL formul over AP ; desired result φ for ugmented systems, n LTL formul over AP ; nd spect mchine A nd pointcut descriptor ρ over AP. Perform the following: 0. If it does not lredy, ugment ψ with cluses of the form ( ), such tht ψ contins every tomic proposition AP, without ltering its mening. 1. Construct T ψ, the tleu for ψ. Since ψ contins every AP, the result of Theorem 1 will hold when ll lels in AP re considered. 2. Restrict T ψ to only those sttes rechle vi fir pth. 3. Weve A into T ψ ccording to ρ, otining f T ψ. 4. Perform model checking in the usul wy to determine if f T ψ = φ. 4. CORRECTNESS Given the components defined ove, suppose tht: ft ψ = φ. Wht we hve shown, then, is tht the tleu for ssumption ψ woven with spect A ccording to ρ gives resulting mchine tht stisfies desired ugmented result φ. Our gol is to use the properties of f T ψ to show tht A nd ρ, when woven with ny possile se mchine M for which M = ψ, will lwys yield n ugmented f M such tht f M = φ. The proof elow gives this result for prticulr clss of spects. Theorem 2. Given AP, ψ, φ, A, nd ρ s defined, if ft ψ = φ, then for ny se progrm progrm M over superset of AP such tht A nd ρ re wekly invsive for M, if M = ψ then f M = φ. Proof. Since M nd T ψ contin exctly the sme fir pths s M ρ nd T ρ ψ, nd M = ψ, y Theorem 1, for ny fir pth π M in M ρ = ψ strting from S M ρ 0, there is fir pth π T in T ρ ψ with the sme lels (restricted to AP ). It suffices to show tht fter ugmenting oth of these pointcut-redy mchines, this correspondence still holds. Consider ny fir pth π M in M f strting from n initil stte. Unmodified pth Suppose no stte on π M is leled with pointcut. Then π M must e the sme s some fir pth π M in M ρ, which hs mtching fir pth π T in T ρ ψ. This pth π T contins no sttes leled with pointcut, since for every finite supth of π M, ρ ws not mtched, nd the lels on π T re the sme (restricted to AP ). Since π T hs no sttes leled with pointcut, y the construction of T f ψ, none of the edges long this pth

6 hve een removed during weving. Therefore π T is identicl to fir pth π T in T f ψ, nd we hve mtching pth for π M. Modified pth Pth π M must egin with sequence of k +1 sttes s 0, s 1,..., s k in M ρ, where k 0. Since s k must e rechle from fir pth π sk in M ρ, we cn consider the pth which egins s 0,..., s k nd continues long the reminder of π sk fter s k (see Figure 2). This pth must lso e fir, since it hs the sme infinite til s π sk itself, nd so must hve mtching pth in T ρ ψ ; we egin π T y following this pth. Suppose tht s k = pointcut, so s k+1 is in A. This stte s k cn e leled pointcut if nd only if we hve lel(s 0,..., s k ) ρ. In this cse, the mtching supth in T ρ ψ must lso mtch ρ, nd will hve pointcut on the stte mtching s k. From oth sttes, ll edges go to mchine A, so we cn continue π T long n identicl dvice pth; this includes the cse when the dvice never returns to the se mchine. If nd when π M follows n edge from n spect return stte to stte t 1 in M ρ, it does so to stte which is on fir pth π t1 in tht mchine. There must e mtching pth to π t1 in the tleu. Furthermore, if we continue long sequence of se mchine sttes t 1,..., t l, since t l is lso rechle from fir pth π tl, the pth which reches t 1 vi π t1, goes to t l, nd then continues long π tl from t l is lso fir in M ρ. In f T ψ, we hve n edge from the spect return stte to every stte whose lels mtch t 1; in prticulr, we must hve n edge to the stte corresponding to t 1 on the fir pth mtching our continution from t 1 constructed ove. We cn continue the mtch π T for π M long this pth. If this continution of se mchine sttes is infinite, then the mtching pth in the tleu must e fir, since we re following the mtch of fir pth in M ρ. If we never rech n infinite sequence of se sttes, ut lwys rech nother dvice, then there must e some dvice sttes which re visited infinitely mny times, nd gin the pth in the tleu is fir. Therefore, for every fir pth π M in M f we hve corresponding fir pth π T in T f ψ. This correspondence completes the proof tht M f = φ. 4.1 Exmple By wy of exmple, suppose we hve n spect with se system ssumption ψ = A G (( ) F ) tht is, ny stte stisfying is eventully followed y stte stisfying. We would like to prove tht the ppliction of our spect to ny se system stisfying ψ will give n ugmented system stisfying result φ = A G (( ) X F ) tht is, ny stte stisfying will eventully e followed y lter stte stisfying. While this exmple my not hve cler correltion to code-level prolem, it serves to illuminte the cpilities of our technique. Figure 3 shows the rechle portion of the tleu for the ssumption ψ. In the digrm, shded sttes re those contined in the only firness set. The nottion Xg, not ctully Xg Xg s 0 s 1 Xg Xg s 2 s 3 s 4 s 5 Figure 3: The rechle portion of tleu T ψ for ψ = A G (( ) F ). Xg Figure 4: A simple spect mchine A. Xg s 6 s 0 s 1 Xg Xg s 2 s 3 s 4 s 5 s 6 Figure 5: Augmented tleu f T ψ, stisfying φ = A G (( ) X F ).

7 prt of the stte lel, designtes sttes in the tleu which stisfy Xg for suformul g = F. For the exmple pointcut descriptor ρ = ( ), this tleu mchine is lso pointcutredy for ρ (since ρ references only the current stte), simply y dding pointcut to the lels of s 3 nd s 5. s 0 c Figure 4 shows the stte mchine A for the dvice of our spect. This dvice will e pplied t the sttes mtched y ρ, nd Figure 5 gives the weving of A with T ψ ccording to ρ. Model checking this ugmented tleu will indeed estlish tht it stisfies the desired property φ. This result follows neither from the spect nor se mchine ehvior directly, ut from their comined ehvior medited y ρ. And since T f ψ = φ, ny M = ψ will yield M f = φ. c s 1 c Resoning intuitively out A nd ρ without exmining the tleu supports this conclusion: the dvice is invoked t ll sttes of such n M tht mtch ( ), the dvice lwys leds to stte stisfying ( ), nd ψ gurntees tht from such stte we will lwys rech stte stisfying, which is exctly the ssertion of φ. Figure 6 depicts prticulr se mchine M stisfying ψ, s could e esily verified y model checking. Agin, the shded sttes re those in the only firness set. Although this M is smll, it does contin tomic proposition c not visile to the spect, nd it hs disconnected structure very much unlike the tleu. From Figure 7, one sees it is indeed the cse tht the ugmented mchine M f stisfies φ ut there is no need to prove this directly y model checking. This holds true even though the ddition of the spect hs mde numer of invsive chnges to M: stte s 1 is no longer rechle, ecuse its only incoming edge hs een replced y n dvice edge; new loop through s 0 hs een dded, when in M there ws no pth visiting s 0 more thn once; there is new pth connecting the previously seprted left-hnd component to the right-hnd; nd so forth. In more relistic exmples, the difference in size etween the ugmented tleu (involving only ψ, ρ, nd A) nd concrete ugmented system with dvice over full se mchine would e sustntil. 5. RELATED WORK The first work to seprtely model check the spect stte mchine segments tht correspond to dvice is [9], where the verifiction is modulr in the sense tht se nd spect mchines re considered seprtely. The verifiction method lso llows for joinpoints within dvice to e mtched y pointcut nd themselves dvised. However, the tretment there is for prticulr spect woven directly to prticulr se progrm. Additionlly, it shows only how to extend properties which hold for tht se progrm, proving tht the ugmented progrm stisfies them s well (properties re specified in rnching-time logic CTL). A key ssumption of their method is tht fter the spect mchine completes, the continution is lwys to the stte following the joinpoint in the originl se progrm. This requirement is much stronger thn the ssumption used here of wekly invsive spect. In [8], model checking tsks re utomticlly generted for the ugmented system tht results from ech weving of n spect. Tht pproch hs the disdvntge of hving to Figure 6: One prticulr se mchine M = ψ. c s 1 s 0 Figure 7: Augmenting M with A ccording to ρ gives result M f = φ. tret the ugmented system, ut t lest the needed nnottions nd set-up need only e prepred once. Tht work tkes dvntge of the Bnder [5] system tht genertes input to model checking tools directly from Jv code, nd cn e extended to, for exmple, the spect-oriented AspectJ lnguge. Bnder nd other systems like Jv Pthfinder [6] tht generte stte mchine representtions from code cn e used to connect common high-level spect lnguges to the stte mchines used in the results here. In [7] semntic model sed on stte mchines is given, nd the tretment of code-level spects nd joinpoints defined in terms of trnsitions, s in AspectJ, is descried. In prticulr, the vritions needed to express in stte mchine weving the mening of efore, fter, nd round with proceed re outlined, lthough work remins to fully cpture the intended semntics. In [4] nd [11], mong others, n ssume-gurntee structure for spect specifiction is suggested, similr to the specifictions here, ut model checking is not used. 6. CONCLUSION By reusing the notion of tleu which contins ll possile ehviors tht stisfy prticulr formul, we cn chieve modulr verifiction for spects y ugmenting the tleu with the dvice ccording to pointcut descriptor nd ex- c c

8 mining the result. In order to do so we must restrict our view to spects which re wekly invsive nd lwys return to sttes which were rechle in the originl se system, nd we tke lierl view of firness in which ny computtion tht infinitely often visits n spect stte is considered fir. A numer of directions for future work present themselves quite clerly. While the current technique only ddresses single spect nd pointcut descriptor, in principle it cn e extended to work for multiple spects, given proper definitions of the weving mechnics. Further development of how weving is formulted will lso llow tretment of cses where dvice introduction chnges the set of joinpoints. Furthermore, the entire discussion here is given in terms of sttes nd stte mchines, while, s noted erlier, the usul sic voculry of spect-oriented progrmming tlks out events. The lnguge-level spect terminology nd prolems of rel oject systems still must e fully expressed in the stte-sed model checking used here. Nevertheless, the generic method in this pper llows us for the first time to model check spects independently of concrete se progrm, nd is significnt step towrd the truly modulr verifiction of spects. [9] S. Krishnmurthi, K. Fisler, nd M. Greenerg. Verifying spect dvice modulrly. In Proc. SIGSOFT Conference on Foundtions of Softwre Engineering, FSE 04, pges ACM, [10] NuSMV. [11] H. Sipm. A forml model for cross-cutting modulr trnsition systems. In Proc. of Foundtions of Aspect Lnguges Workshop (FOAL03), REFERENCES [1] E. Arhm, F. de Boer, W.-P. de Roever, nd M. Steffen. An ssertion-sed proof system for multithreded jv. Theoreticl Computer Science, 331(2-3): , [2] D. Bustn, A. Flisher, O. Grumerg, O. Kupfermn, nd M. Y. Vrdi. Regulr vcuity. In D. Borrione nd W. Pul, editors, Proc. of Correct Hrdwre Design nd Verifiction Methods, CHARME 05, volume 3725 of LNCS, pges Springer, [3] E. M. Clrke, Jr., O. Grumerg, nd D. A. Peled. Model Checking. MIT Press, Cmridge, MA, [4] B. Devereux. Compositionl resoning out spects using lternting-time logic. In Proc. of Foundtions of Aspect Lnguges Workshop (FOAL03), [5] J. Htcliff nd M. Dwyer. Using the Bnder Tool Set to model-check properties of concurrent Jv softwre. In K. G. Lrsen nd M. Nielsen, editors, Proc. 12th Int. Conf. on Concurrency Theory, CONCUR 01, volume 2154 of LNCS, pges Springer-Verlg, [6] K. Hvelund nd T. Pressurger. Model checking Jv progrms using Jv PthFinder. Interntionl Journl on Softwre Tools for Technology Trnsfer (STTT), 2(4), Apr [7] S. Ktz. Aspect ctegories nd clsses of temporl properties. In Trnsctions on Aspect Oriented Softwre Development, Volume 1, LNCS 3880, pges , [8] S. Ktz nd M. Sihmn. Aspect vlidtion using model checking. In Proc. of Interntionl Symposium on Verifiction, LNCS 2772, pges , 2003.