Verification of Modifies Clauses in Dynamic Logic with Non-rigid Functions

For modular verification of object-oriented programs, it is necessary to constrain what may be changed by a method in addition to how it is changed. Doing so with the classical means of preand postconditions is cumbersome, and even impossible if the program context is not entirely known. Therefore, specifications make use of an additional construct, known as a “frame property” or “modifies clause”, which lists the memory locations that can at most be modified. Deductively verifying the correctness of such modifies clauses is difficult because the focus is on those locations which are not mentioned in the modifies clause. We present a novel approach to encode the correctness of modifies clauses as compact and readable proof obligations in dynamic logic. These proof obligations can be discharged efficiently with existing dynamic logic calculi, such as the one implemented in the KeY verification system. Additionally, we describe how a variant of our technique can be used for the verification of loops.