Page 1

Java’s Integral Types in PVS

Bart Jacobs

Dep. Comp. Sci., Univ. Nijmegen,

P.O. Box 9010, 6500 GL Nijmegen, The Netherlands.

bart@cs.kun.nl

February 20, 2003

Abstract. This paper extends PVS’s standard bitvector library with multiplica-

tion, division and remainder operations, together with associated results. This ex-

tension isneeded togiveappropriate semanticstoJava’s integral typesin program

verification. Special emphasis is therefore put on Java’s widening and narrowing

functions in relation to the newly defined operations on bitvectors.

1Introduction

Many programmming languages offer different integral types, represented by different

numbers of bits. In Java one has types byte (8 bits), short (16 bits), int (32 bits)

and long (64 bits). Additionally, there is a 16 bit type char for unicode characters,

see [6,

ferences and interpret all of these types as the unbounded, mathematical integers. This

same approach has been followed until recently within the Java verification technol-

ogy developed in Nijmegen around the LOOP translation tool [1] and the PVS theorem

prover [12].

During the last few years the main application area for the LOOP tool is Java Card

based smart cards. Within this setting the abovementioned abstraction of integral types

is problematic, because of the following reasons.

??4.2.1]. It is a usual abstraction in program verification to disregard these dif-

– Given the limited resources on a smart card, a programmerchooses his/her integral

data types as small as possible, so that potential overflows are a concern (see [4,

Chapter14]). Since such overflowsdo not produceexceptions in Java (like in Ada),

a precise semantics is needed.

– Communication between a smart card and a terminal uses a special structured byte

sequence, called an “apdu”, see [4]. As a result, many low-level operations with

bytes occur frequently, such as bitwise negation or masking.

– Unnoticed overflow may form a security risk: imagine you use a short for a se-

quence number in a security protocol, which is incremented with every protocol

run. An overflow then makes you vulnerable to a possible replay attack.

Attention in the theorem proving community has focused mainly on formalising

properties of (IEEE 754) floating-point numbers, see e.g. [2,7,8,14]. Such results are

of interest in the worlds of microprocessor construction and scientific computation.

However, there are legitimate concerns about integral types as well. It is argued in [15]

Page 2

that Java’s integral types are unsafe, because overflow is not detected via exceptions,

and are confusingbecause of the asymmetric way that conversionswork: argumentsare

automatically promoted, but results are not1.

The verification approach centered around the LOOP tool uses the specification

language JML [10,11] in order to express the required correctness properties for Java

programs. Such (simple) properties can also be checked statically with the ESC/Java

tool [5],but such checkingignoresintegralbounds.The theoremproverbased approach

with the semantics of this paper will take bounds into account. In [3] it is proposed that

a specification language like JML for Java) should use the mathematical (unbounded)

integers, for describing the results of programs using bounded integral types, because

“developers are in a different mindset when reading or writing specifications, particu-

larly when it comes to reasoning about integer arithmetic”. This issue is not resolved

yet in the program specification community—and it will not be settled here. Anyway,

Instead, this paper describes the new semantics for Java’s integral types developed

for the LOOP tool. This semantics is based on PVS’s (standard) bitvector library. This

PVS library describes bitvectors of arbitrary length, given as a parameter, togetherwith

functions bv2nat and bv2int for the unsigned (one’s-complement) and signed (two’s-

complement) interpretation of bitvectors. Associated basic operations are defined, such

as addition, subtraction, and concatenation. In this paper, the following items are added

to this library.

1. Executable definitions. For instance, the standard library contains “definitions by

specification” of the form:

-(bv: bvec[N]): { bvn: bvec[N] | bv2int(bvn) =

IF bv2int(bv) = minint THEN bv2int(bv)

ELSE -(bv2int(bv)) ENDIF}

*(bv1: bvec[N], bv2: bvec[N]): {bv: bvec[2*N] | bv2nat(bv) =

bv2nat(bv1) * bv2nat(bv2)}

Such definitions2are not so useful for our program verifications, because some-

times we need to actually compute outcomes. Therefore we give executable redefi-

nitions of these operations. Then we can compute, for instance, (4*b)&0x0F.

2. Similarly, executable definitions are introduced for division and remainder opera-

tions,whicharenotpresentinthestandardlibrary.We give suchdefinitionsbothfor

unsigned and signed interpretations, following standard hardware realisations via

shifting of registers. The associated results are non-trivial challenges in theorem

proving.

3. Typically for Java we introduce so-called widening and narrowing, for turning a

bitvectorof length

? into oneoflength

??? and back,see [6,

??5.1.2and

??5.1.3].

1For a byte (or short) b, the assignment b = b-b leads to a compile time error: the arguments

of the minus function are first converted implicitly to int, but the result must be converted

explicitly back, as in b = (byte)(b-b).

2Readers familiar with PVS will see that these definitions generate so-called type correctness

conditions (TCCs), requiring that the above sets are non-empty. These TCCs can be proved

via the inverses int2bv and nat2bv of the (bijective) functions bv2int and bv2nat, see

Section 2. The inverses exist because one has bijections, but they are not executable.

Page 3

When, for example, a byte is added to a short, both arguments are first “promoted”

in Java-speak to integers via widening, and then added. Appropriate results are

proven relating for instance widening and multiplication or division.

As a result the familiar cancellation laws for multiplication ( ?

We show how our definitions of multiplication, division and remaindersatisfy all prop-

erties listed in the Java Language Specification [6,

In particular we get a good handle on overflow, so that we can prove for the values

minint = 0x80000000 and maxint = 0x7FFFFFFF, the truth of the follow-

ing Java booleans.

??15.17.1-3].

minint - 1 == maxint

minint * -1 == minint

minint / -1 == minint

maxint + 1 == minint

maxint * maxint == 1

??????????, for

????) and for division (

???

???

?

?

?, for

?????????) do not hold, since:

minint * -1 == minint * 1 (minint * -1) / (minint * 1) == 1

But these cancellationlaws do holdin case thereis no overflow.Similarly, we can prove

the crucial propertyof the familiarmask to turnbytes into nonnegativeshorts: fora byte

b,

(short)(b & 0xFF) == (b >= 0) ? b : (b + 256)

Integralarithmeticis averybasictopicincomputerscience(seee.g.[13]).Mostthe-

orem provers have a standard bitvector library that covers the basics, developed mostly

for hardware verification. But multiplication, division and remainder are typically not

included. The contribution of this paper lies in the logical formalisation of these oper-

ations and their results, and in linking the outcome to Java’s arithmetic, especially to

its widening and narrowing operations. These are the kind of results that “everybody

knows” but are hard to find and easy to get wrong.

Thispaperhasasimplestructure.ItstartsbyexplainingthebasicsofPVS’s standard

bitvector library. Then, in Section 4 it describes our definition of multiplication with

associated properties. Division and remainder operations are more difficult; they are

first described in unsigned (one’s-complement) form in Section 5, and subsequently in

signed (two’s-complement) form in Section 6. Although the work we have done has

been carried out in the language of a specific theorem prover (namely PVS), we shall

use a general, mathematical notation to describe it.

2 PVS’s standard bitvector library

The distribution of PVS comes with a basic bitvector library3. We sketch some in-

gredients that will be used later. A bit is defined as in PVS as a boolean, but here

we shall equivalently use it as an element of

def

?????. A bitvector of length

? is a

function in bvec ????

?below???? bit

?, where below

??? is the

?-element set

3Developed by Butler, Miner, Carre˜ no (NASA Langley), Miller, Greve (Rockwell Collins) and

Srivas (SRI International).

Page 4

?????

bv2nat-rec ?bv?

???????? of natural numbers below

bv ??

?. For instance, the null bitvector is

??

Similarly, one can write

Clearly, bv2nat is bijective. And also: bv2nat?bv?

? below

?????, which we shall often write as

??

? , leaving the length

? implicit.

??

? for

??? below?????. It should be distinguished from 1 =

??? below??

The unsigned interpretation of bitvectors is given by the (parametrised) function

bv2nat

??if

??? then

? else

?.

? bvec ???? below??

?

?, defined as:

bv2nat

?bv ?

def

? bv2nat-rec ?bv????

where

??

def

?

?

?

if

???

? ????

???

? bv2nat-rec ?bv ??? ?? if

???

(1)

??? bv

?

??

? , bv2nat?bv??

?

?

?

The signed interpretation is given by a similar function bv2int

?? bv

?

??

? , and bv2nat?bv???? bv

? 1.

? bvec ???????

????

???

??????

???

?. It is defined in terms of the unsigned interpretation:

bv2int

?bv?

def

?

?

bv2nat

bv2nat

?bv ?

if bv2nat

?bv???

???

?bv ???

?otherwise.

(2)

The condition bv2nat

?bv ???

???means that the most significant bit bv??? ?? is

?. Therefore, this bit is often called the sign bit, when the signed interpretation is used.

This bv2int function is also bijective.

The PVS bitvector library provides various basic operations and results. For in-

stance, there is an (executable) addition operation

recursively defined adder. A unary minus operation

tion, as described in the introduction. Binary minus is then defined as: bv

bv

tation. A typical result is:

? on bitvectors, introduced via a

? is introduced via a specifica-

?

? bv

?

def

?

?

???bv

?

?. These operations work for both the unsigned and for the signed interpre-

bv2int

?bv

bv2int

?

? bv

?

?

?

?

?

?

?

?

?

?

?

?

?bv

?

?? bv2int

?bv

?

?

if

and bv2int

??

?

bv ??

??

? bv2int?bv

?

?? bv2int

?bv

?

?

?bv

?

?? bv2int?bv

?

???

???

bv2int

bv2int

?bv

?

?? bv2int

?bv

?

???

?if bv2int

?bv

?

??? and bv2int?bv

?

???

?bv

rsh??

?

?? bv2int

?bv

?

???

?otherwise.

The second cases deals with overflow, and the third one with underflow. The library

shows, among other things, that the structure

group.

Also we shall make frequent use of left and right shift operations. For

?bvec ??????

??

???? is a commutative

???,

lsh???bv ?? ??? below

????

?

??? if

???

?

otherwise.

?bv ?? ??? below

????

?

bv ????? if

?????

?

otherwise.

Page 5

3 Widening and narrowing

widen?bv?

As mentioned in the introduction, Java uses so-called widening and narrowing opera-

tions to move from one integral type to another. These operations can be described in a

parametrised way, as functions:

widen

? bvec ???? bvec ?????

and

narrow

? bvec ?????? bvec ???

defined as:

def

? ??? below??????

?

bv ???

if

???

bv ??? ?? otherwise

narrow

?BV ?

def

? ??? below????BV ???

Thus, narrowing simply ignores the first

the unsigned interpretation is unaffected, in the sense that:

? bits. The key property of widening is that

bv2int

?widen ?bv??

narrow?widen ?bv??

? bv2int

?bv?

A theme that will re-appear several times in this paper is that after widening there is no

overflow:

bv2int

?widen ?bv

?

?? widen ?bv

?

?

?

? bv2int

?bv

?

?? bv2int

?bv

?

?

bv2int

?

? widen?bv?

?

??bv2int

?bv??

(3)

There are similar results about narrowing. First:

? bv?

But also:

narrow

?BV

narrow

?

? BV

widen ?widen ????

?

?? narrow

?BV

?

?? narrow?BV

?

?

??BV ???narrow

?BV ??

TheLOOPtooluseswideningandnarrowinginthetranslation ofJava’sarithmetical

expressions. For instance, for a byte b and short s, a Java expression

(short)(b + 2*s)

is translated into PVS as:

narrow

?

??? widen ???

?

because the arguments are “promoted” in Java to 32 bit integers before addition and

multiplication are applied.

In this way we can explain (and verify in PVS) that for byte b = -128, one has

in Java: b-1 is

???? and (byte)(b-1) is

???.

Page 6

4Multiplication

This section describes bitvectormultiplication in PVS, following the standard pen-and-

paper approach via repeated shifting and adding. The definition we use works well

under both the unsigned and signed interpretation.

In ourparametrised setting, we use a recursivedefinition for multiplication.Fortwo

bitvectors bv

lsh???times-rec ?rsh???bv

where iterate ??

allows us to prove familiar results, like

?

?bv

?

? bvec ??? of length

?, we define:

bv

?

? bv

?

def

? times-rec ?bv

?

?bv

?

???

where for a natural number

?,

times-rec ?bv

?

?bv

?

???

def

?

?

?

?

?

?

??

?

if

???

bv

?

? lsh???times-rec ?rsh???bv

?

??bv

?

??? ??? if

??? and bv

?

?????

?

??bv

?

??? ???

if

??? and bv

?

?????

Notethat inthis definitionbv

plication by specification from the standard PVS library (describedin the introduction),

which doubles the length.

A crucial result is that (our) multiplication can be expressed simply as iterated ad-

dition, an appropriate number of times.

?

?bv

?hasthe samelengthas bv

?andbv

?, unlikethemulti-

bv

?

? bv

?

? iterate ???? bvec ?????? bv

?

?bv2nat

?bv

?

???

??

???

?? ???? is

?

???

?????????????????, i.e.

? applied

? times to

?. This

??

?? bv

?

??

?

bv

?

? bv

?

? bv

?

? bv

?

1

? bv

bv

? bv

??bv

?

?? bv

?

???bv

?

? bv

?

?

bv

?

??bv

?

? bv

?

???bv

?

? bv

?

?? bv

??

??bv

?

? bv

?

?? bv

?

? bv

?

? bv

?

? bv

?

They express that

group structure

As for the interpretation, the following two results are most relevant.

?bvec ??????1 ? is a commutative monoid, and that

? preserves the

?bvec ??????

??

????.

bv2nat

?bv

?

?? bv2nat

?bv

?

???

?

?? bv2nat

?bv

?

? bv

?

?? bv2nat?bv

?

?? bv2nat?bv

?

?

??

???

? bv2int

?bv

?

?? bv2int

?bv

?

? and bv2int

?bv

?

?? bv2int

?bv

?

???

???

?? bv2int

?bv

?

? bv

?

?? bv2int

?bv

?

?? bv2int

?bv

?

??

This means that we have an analogue of (3) for multiplication: after widening there is

no overflow:

bv2int

?widen ?bv

?

?? widen ?bv

?

??? bv2int

?bv

?

?? bv2int?bv

?

??

(4)

Page 7

This result is very useful in actual calculations (in PVS, about Java programs). For the

general situation, with possible over- or under-flow, we have the following formula that

slices the (mathematical) integers into appropriate ranges.

??????

bv2int

??

?

??

???

? bv2int

?bv

?

?? bv2int?bv

?

??

?bv

?

?? bv2int

?bv

?

?????

?

??

???

?? bv2int?bv

?

? bv

?

?? bv2int

?bv

?

?? bv2int

?bv

?

?????

?

?

Finally, we have the following two results about multiplication and narrowing.

narrow

?BV

?

? BV

?

?? narrow

?BV

?

?? narrow

?BV

?

?

bv

?

? bv

?

? narrow

?

widen ?bv

?

?? widen ?bv

?

?

?

(5)

This second result follows immediately from the first. It is of interest because it shows

that our multiplication satisfies the following requirement from the Java Language

Specification [6,

??15.17.1]:

If an integer multiplication overflows, then the result is the low-order bits

of the mathematical product as represented in some sufficiently large two’s-

complement format.

The “lower-order bits” result from the narrow in narrow

?widen ?bv

?

?? widen ?bv

?

?

?

in (5)’s second equation, and the “mathematical product” is its argument widen ?bv

?

??

widen ?bv

?

?, as expressed by (4).

5 Unsigned division and remainder

Division and remainderforbitvectors are less straightforwardthan multiplication.They

are based on the same pen-and-paperprinciples, but the verifications are more involved.

Inthissectionwedescribea standardmachinealgorithmfor theunsignedinterpretation,

see e.g. [13, 8.3]. The next section adapts this approachto the signed interpretation,and

shows how it can be used for division in Java.

rem?dvd ?dvs

In the description below we use arbitrary bitvectors dvd ?dvs

fixed length

used in dvd

Unsigned division and remainder are defined via first and second projections of a

recursive auxiliary function:

?rem?quot

?aux, of a

?. The abbreviation dvd stands for ‘dividend’, and dvs for ‘divisor’, to be

? dvs and dvd

? dvs.

div ?dvd ?dvs

?

def

??

?divrem?dvd ?dvs ?

??

????

?

def

??

?divrem?dvd ?dvs ?

??

?????

Page 8

where for

???,

divrem?dvd ?dvs

?rem? ??

def

??dvd ?rem?

divrem?dvd ?dvs ?rem??? ??

def

? let dvd

?

? lsh???dvd ??

rem

?

? lsh???rem? with

?????? dvd ??? ??℄

in if bv2nat?dvs ?? bv2nat

?rem

?

?

then divrem?dvd

?with

???????℄?

dvs ?rem

?

? dvs

??? ??

else divrem?dvd

?

?dvs ?rem

?

??? ???

The ‘with’ operator is a convenient short-hand for function update:

the function

The definition of divrem is quite sneaky and efficient, since it uses very few argu-

ments(orregistersin ahardwareimplementation).The dvd argumentis shiftedfromthe

left into rem, and at the same time the quotient result is built up in dvd from the right.

Thisoverloadeduseof dvd makesit impossibletoformulateanappropriateinvariantfor

this recursive function.Thereforewe introducean alternative function divrem* without

this overloading,show that divrem* computesthe same result as divrem, andformulate

and prove an appropriate invariant for divrem*.

then divrem* ?aux

? with

???? ???℄ is

? with

????? if

??? then

? else

????.

divrem* ?aux ?dvd ?dvs ?rem? ??def

?

?aux ?dvd ?rem?

else divrem* ?aux

divrem* ?aux ?dvd ?dvs ?rem?

let aux

dvd

rem

in if bv2nat

?? ??

def

?

?

? lsh ???aux

? with

???? ?? dvd ??? ??℄

?

? lsh???dvd

??

?

? lsh???rem

? with

?????? dvd ??? ??℄

?dvs ?? bv2nat?rem

?

?

?

?dvd

?with

???? ???℄?dvs

?

?

??? below????if

???????

then rem

then rem??? else

?

??? else

?

?

? dvs

??? ??

?

?dvd

?

?dvs ?rem

?

??? ???

In this definition the original argument dvd is also shifted into the aux register, so that

it is not lost and can be used for the formulation of the invariant. Also, the subtraction

of dvs from rem

The fact that divrem and divrem* computethe same results is expressedas follows.

For all

?, if possible, happens only from the relevant, lower part of rem

?.

???,

let dr*

? divrem* ?aux ?dvd ?dvs

?rem????

dr

? divrem?dvd ?dvs ?

?

??? below

????if

???

?

?

???

in

?

?dr*

? ??? below????if

??? then dvd ??????? else aux ??????

?

?dr*

??

?dr

?

?

?dr*

??

?dr ?

Page 9

Note that for

a result, division and remainder can also be expressed in terms of divrem*:

???, the third argument of divrem is simply rem, and

?

?dr*

? dvd. As

div ?dvd ?dvs ???

?divrem* ?

??

??dvd ?dvs ?

??

????

rem?dvd ?dvs ???

?divrem* ?

??

??dvd ?dvs ?

??

?????

We are now in a position to express the key invariant property. For

bv2nat??

bv2nat?dvs ?

???,

let dvd n

quot n

rem n

dr*

bv2nat?dvd ?

? ??? below

????if

??? then dvd ??????? else aux

??????

? ??? below

????if

????? then dvd ??? else

??

? ??? below

????if

??? then dvd ??????? else rem??????

? divrem* ?aux ?dvd ?dvs ?rem???

in bv2nat?dvd n ???

?

? bv2nat

?dvs

?? bv2nat

?quot n ?? bv2nat?rem n ?

??

?dr* ?? bv2nat

?dvs ?? bv2nat??

?dr* ?? bv2nat

??

?dr* ?

The proof of this property is far from trivial. The most interesting case is when

We then have dvd n

implication

???.

? dvd, quot n

?

??

? and rem n

? dvd, so that the antecedent of the

rem?dvd ?

?? trivially holds. This yields a first success:

? bv2nat

?dvs

?? bv2nat

?div ?dvd ?dvs ??? bv2nat?rem ?dvd ?dvs

???

(6)

It is not hard to prove the expected upperbound for remainder:

????? bv2nat?rem?dvd ?dvs

??? bv2nat

?dvs ??

(7)

The restriction to non-null divisors is relevant, because:

div

?dvd ?

??

?

??

??

?

and

??

?

?? dvd

?

Division and remainder in Java throw an exception when the divisor is null. We re-

alise this behaviour via a wrapper function around the bitvector operations that we are

describing.

These two results (6) and (7) characterise division and remainder, in the following

sense.

??????? bv2nat

?dvs ?????? bv2nat?dvd ???? bv2nat?dvs ?

???? bv2nat?div

?dvd ?dvs

????? bv2nat?rem ?dvd ?dvs

???

(8)

This is, together with (6) and (7), the main result of this section. It allows us to prove

various results about (unsigned) division and remainder, such as:

div ?dvd ?1 ?? dvd

and

rem?dvd ?1 ??

??

?

?

And:

bv2nat

?div ?dvd ?dvs ?????? bv2nat

?dvd ?? bv2nat

?dvs ??

Page 10

6 Signed division and remainder

Our aim in this section is first to introduce signed division and remainder operations,

and prove the analogues of (6), (7) and (8). Next we intend to prove the properties that

are listed in the Java Language Specification [6] about division and remainder.

Before we move from unsigned division and remainder to the signed versions (as

used in Java), we recall that:

??????????

????????????

then rem?dvd ?dvs ?

?

????????????

else rem?dvd ?

else if bv2int

then

else

??

????????????????

In line with these results, we make the following case distinctions:

else div ??dvd ?

dvd

? dvs

def

dvd

? dvs

def

? if bv2int

then if bv2int

?dvd ??

?

?

?dvs ???

then div ?dvd ?dvs

else

else if bv2int

then

?

? div ?dvd ??dvs

??

?dvs ???

? div ??dvd

?dvs ??

?dvs

?

? if bv2int

then if bv2int

?dvd ???

?dvs ???

?dvs

??

?dvs ???

? rem??dvd ?dvs ??

? rem??dvd ??dvs

?

Using the properties of unsigned division and remainder we quickly get:

dvd

?

??

??

??

? if bv2int

1 otherwise.

?dvd ???

dvd

?

??

?? dvd

dvd

? 1

? dvddvd

? 1

?

??

??

The signed analogue of (7) involves the absolute value function:

bv2int

?dvs ?????? abs ?bv2int

?dvd

? dvs ??? abs ?bv2int

?dvs ???

(9)

The analogue of (6) involves an overflow exception:

?

?bv2int

?dvd ????

???

? bv2int

?dvs ????

?

??

bv2int

?dvd ?? bv2int

?dvs ?? bv2int

?dvd

? dvs ?? bv2int

?dvd

? dvs

??

(10)

The proof of this property is obtained from (6), applied after the various case distinc-

tions. The overflow case—when dvd

because:

? minint and dvs

?

??

? —does not satisfy (10)

bv2int

?minint

?

??

?

????

???

bv2int

?minint

?

??

?

????

Page 11

Actually, we can move the bv2int’s in (10) to the outside and remove them (because

bv2int is injective). This yields:

dvd

? dvs

?

?dvd

? dvs

?

?

?dvd

? dvs

?

?

(11)

The restriction from (10) disappears in this form—where

tion 4, with its own overflow behaviour.

Next we turn to the sign of signed division and remainder. It is most complicated

for division.

? is multiplication from Sec-

?

?bv2int

?dvd ????

???

? bv2int

?dvs ????

?

? bv2int

?dvs ????

??

?

bv2int

?dvd

? dvs ?????bv2int

?dvd ?? bv2int

?dvs ?? bv2int

?dvs ?? ??

??bv2int

?dvd ?? bv2int

?dvs

?? bv2int

?dvs ?? ??

?

?

?

bv2int

?dvd

? dvs ???? abs ?bv2int

?dvd ??? abs ?bv2int

?dvs ??

?

?

?

bv2int

?dvd

? dvs ?????bv2int

?dvd ???bv2int

?dvs ?? bv2int

?dvs ?? ??

??bv2int

?dvd ???bv2int?dvs ?? bv2int

?dvs ?? ??

?

(12)

About the sign of the remainder we can only say it is determined by the sign of the

dividend:

bv2int

bv2int

?dvd ????? bv2int

?dvd

? dvs

???

?dvd ????? bv2int

?dvd

? dvs

????

(13)

The uniqueness of signed division and remainder requires more assumptions than

in the unsigned case (8). It involves for instance the above sign descriptions.

????????

bv2int

?bv2int

?dvd ????

???

? bv2int

?dvs

????

?

?

?dvs ?????

?

?????bv2int

?dvd ?? bv2int?dvs ?? bv2int

?dvs ?? ??

??bv2int

?dvd ?? bv2int

?dvs ?? bv2int?dvs ?? ??

?

?

?

???? abs ?bv2int

?dvd ??? abs ?bv2int

?dvs ??

?

?

?

?????bv2int

?dvd ???bv2int?dvs ?? bv2int

?dvs ?? ??

??bv2int

?dvd ???bv2int?dvs ?? bv2int

?dvs ?? ??

?

?

?

bv2int

?dvd ???????

?

?

?

bv2int

?dvd ???????

?

?

abs ??

bv2int

?? abs ?bv2int

?dvs ???

?dvs ?????? bv2int

?dvd ?

??

?? bv2int?dvd

? dvs ???? bv2int

?dvd

? dvs ??

(14)

Page 12

Finally, as consequence, we obtain the relation between widening and division &

remainder, following (3) for addition and (4) for multiplication.

?

?bv2int

?dvd ????

???

? bv2int

?dvs ????

?

?? widen?dvd ?? widen ?dvs ?? widen ?dvd

? dvs ??

widen?dvd ?? widen ?dvs ?? widen ?dvd

? dvs ??

(15)

6.1 Division in Java

We start with a quote from the Java Language Specification [6,

??15.17.2].

Integer division rounds toward 0. That is, the quotient produced for operands

? and

value

moreover,

when and

not satisfy this rule: if the dividend is the negative integer of largest possible

magnitude for its type, and the divisor is -1, then integer overflow occurs and

the result is equal to the dividend. Despite the overflow,no exception is thrown

in this case. On the other hand, if the value of the divisor in an integer division

is 0, then an ArithmeticException is thrown.

? that are integers after binary numeric promotion (

?5.6.2) is an integer

? whose magnitude is as large as possible while satisfying

?????????;

? is positive when and

? and

? have the same sign, but

? is negative

? and

? have opposite signs. There is one special case that does

We check that all these propertieshold foroursigneddivisionand remainderoperations

defined on bitvectors in PVS. The first property stating that the quotient is “...as large

as possible ...” is formalised (and proven) as:

????? bv2int

?dvs ????? abs ?bv2int

?dvs ????? abs ?bv2int

?dvd ??

?? abs ???? abs ?bv2int

?dvd

? dvs ???

The sign of the quotient has already been described in (12). And the “...one special

case ...” in this quote refers to the assumption in (10).

6.2Remainder in Java

The relevant quote [6,

??15.17.3] says:

The remainder operation for operands that are integers after binary numeric

promotion(

to

tive integer of largest possible magnitude for its type and the divisor is -1 (the

remainder is 0). It follows from this rule that the result of the remainder op-

eration can be negative only if the dividend is negative, and can be positive

only if the dividend is positive; moreover,the magnitude of the result is always

less than the magnitude of the divisor. If the value of the divisor for an integer

remainder operator is 0, then an ArithmeticException is thrown.

?5.6.2) produces a result value such that

????????????? is equal

?. This identity holds even in the special case that the dividend is the nega-

Page 13

The identity “?????

therestrictionthatoccursin (10).Thestatementaboutthe signoftheremainderis stated

in (13), and about its magnitude in (9).

We conclude that all properties of division and remainder required in the Java Lan-

guage Specification hold for our formalisation in PVS.

????????is equal to

?” in this quoteholds as (11),indeedwithout

7 Conclusions

This paper has formalised the details of multiplication, division and remainder opera-

tions for bitvectors in the higher order logic of the theorem prover PVS, and has made

precise which properties that this formalisation satisfies. This is typical theorem prover

work, involving many subtle details and case distinctions (which humans easily get

wrong). The main application area is Java program verification. Therefore, the rela-

tion between the newly defined bitvectoroperationsand Java’s wideningand narrowing

functions gets much attention.

The theories underlying this paper have recently been included (by Sam Owre) in

the bitvector library of PVS version 3.0 (and upwards). Also, the bitvector semantics is

now heavily used for verifying specific Java programs, see for instance [9].

Acknowledgements

Thanks are due to Joseph Kiniry for his feedback on this paper.

References

1. J. van den Berg and B. Jacobs. The LOOP compiler for Java and JML. In T. Margaria and

W. Yi, editors, Tools and Algorithms for the Construction and Analysis of Systems, number

2031 in Lect. Notes Comp. Sci., pages 299–312. Springer, Berlin, 2001.

2. V.A. Carre˜ no and P.S. Miner. Specification of the IEEE-854 floating-point standard in HOL

and PVS. In E.Th. Schubert, Ph.J. Windley, and J. Alves-Foss, editors, Higher Order Logic

Theorem Proving and Its Applications, 1995. Category B Proceedings, available at URL

http://lal.cs.byu.edu/lal/hol95/Bprocs/indexB.html.

3. P. Chalin. Back to basics: Language support and semantics of basic infinite integer types in

JML and Larch. Techn. rep. CU-CS 2002.003.1

www.cs.concordia.ca/˜faculty/chalin/,2002.

4. Z. Chen. Java Card Technology for Smart Cards. The Java Series. Addison-Wesley, 2000.

5. C. Flanagan, K.R.M. Leino, M. Lillibridge, G. Nelson, J.B. Saxe, and R. Stata. Extended

static checking for Java. In Proceedings of the 2002 ACM SIGPLAN Conference on Pro-

gramming Language Design and Implementation (PLDI), volume 37 of SIGPLAN Notices,

pages 234–245. ACM, 2002.

6. J. Gosling, B. Joy, G. Steele, and G. Bracha. The Java Language Specification Second

Edition. The Java Series. Addison-Wesley, 2000.

http://java.sun.com/docs/books/jls/second_edition/html/

j.title.doc.html.

7. J. Harrison. A machine-checked theory of floating point arithmetic. In Y. Bertot, G. Dowek,

A. Hirschowitz, C. Paulin, and L. Th´ ery, editors, Theorem Proving in Higher Order Logics,

number 1690 in Lect. Notes Comp. Sci., pages 113–130. Springer, Berlin, 1999.

Page 14

8. J. Harrison. Formal verification of IA-64 division algorithms. In M. Aagaard and J. Harrison,

editors, Theorem Proving in Higher Order Logics, number 1869 in Lect. Notes Comp. Sci.,

pages 234–251. Springer, Berlin, 2000.

9. B. Jacobs, M. Oostdijk, and M. Warnier. Formal verification of a secure payment applet.

Journ. of Logic and Algebraic Programming, 2003. To appear.

10. G.T. Leavens, A.L. Baker, and C. Ruby. JML: A notation for detailed design. In H. Kilov

and B. Rumpe, editors, Behavioral Specifications of Business and Systems, pages 175–188.

Kluwer, 1999.

11. G.T. Leavens, E. Poll, C. Clifton, Y. Cheon, and C. Ruby. JML reference manual (draft).

www.jmlspecs.org, 2002.

12. S. Owre, J.M. Rushby, N. Shankar, and F. von Henke. Formal verification for fault-tolerant

architectures: Prolegomena to the design of PVS. IEEE Trans. on Softw. Eng., 21(2):107–

125, 1995.

13. W. Stallings. Computer Organization and Architecture. Prentice Hall,

14. L. Th´ ery. A library for floating-point numbers in Coq.

www-sop.inria.fr/lemme/AOC/coq/,2002.

15. J.F.H. Winkler. A safe variant of the unsafe integer arithmetic of JavaTM. Software—Practice

and Experience, 33:669–701, 2002.

?thedition, 1996.