Ensuring Invariant Contracts for Modules in Java

Deductive verification of object-oriented programs suffers from the lack of modularity. One of the obstacles to modular verification are invariant contracts, which classes extending a verified system could break. We introduce a concept of modules for Java and their correctness w.r.t. invariant contracts and give a theoretical criterion on attributes called module-protection. To ensure modular fulfilment of invariant contracts, attribute chains that invariants depend on must be module-protected. Finally, we show that each of four known restrictions to enforce modularity imply module-protectedness of attributes.