# Chair of Software Engineering. Software Verification. Assertion Inference. Carlo A. Furia

Save this PDF as:

Size: px
Start display at page:

Download "Chair of Software Engineering. Software Verification. Assertion Inference. Carlo A. Furia"

## Transcription

1 Chair of Software Engineering Software Verification Assertion Inference Carlo A. Furia

2 Proving Programs Automatically The Program Verification problem: Given: a program P and a specification S = [Pre, Post] Determine: if every execution of P, for any value of input parameters, satisfies S Equivalently: establish whether {Pre} P {Post} is (totally) correct A general and fully automated solution to the Program Verification problem is unachievable because the problem is undecidable One of the consequences of this intrinsic limitation is the impossibility of computing intermediate assertions fully automatically (It is not an obvious consequence: formally, a reduction between undecidable problems) 2

3 Proving Programs Automatically The Program Verification problem: Given: a program P and a specification S = [Pre, Post] Determine: if every execution of P, for any value of input parameters, satisfies S Equivalently: establish whether {Pre} P {Post} is (totally) correct One way to put it, practically: Proving the correctness of a computer program requires knowledge about the program that is not readily available in the program text -- Chang & Leino In this lecture, we survey techniques to automatically infer assertions in interesting special cases 3

4 The Assertion Inference Paradox Correctness is consistency of implementation to specification The paradox: if the specification is inferred from the implementation, what do we prove? 4

5 The Assertion Inference Paradox The paradox: if the specification is inferred from the implementation, what do we prove? Possible retorts: - The paradox only arises for correctness proofs; there are other applications (e.g. reverse-engineering legacy software) - The result may be presented to a programmer for assessment - Inferred specification may be inconsistent, thus denoting a problem 5

6 The Assertion Inference Paradox The paradox: if the specification is inferred from the implementation, what do we prove? The paradox does not arise if we only infer intermediate assertions and not specifications (pre and postconditions) - Intermediate assertions are a technical means to an end (proving correctness) tools infer loop invariants - The specification is a formal description of what the implementation should do programmers write specifications 6

7 Invariants Let us consider a general (and somewhat informal) definition of invariant: Def. Invariant: assertion whose truth is preserved by the execution of (parts of) a program. x: INTEGER from x := 1 until... loop x := - x end Some invariants: -1 x 1 x = -1 x = 0 x = 1 x -10 7

8 Kinds of Invariants Def. Invariant: assertion whose truth is preserved by the execution of (parts of) a program. We can identify different types of invariants, according to what parts of the program preserve the invariant: Location invariant at x: assertion that holds whenever the computation reaches location x Program invariant: predicate that holds in any reachable state of the computation Class invariant: predicate that holds between (external) feature invocations Loop invariant: predicate that holds after every iteration of a loop body {P} A {I} {I c} B {I} {P} from A until c loop B end {I c} 8

9 Kinds of Invariants 1: x: INTEGER 2: 3: from x := 1 4: until... 5: loop x := - x end Location invariant at 2: Loop invariant: Program invariant: 9

10 Kinds of Invariants 1: x: INTEGER 2: 3: from x := 1 4: until... 5: loop x := - x end Location invariant at 2: x = 0 Loop invariant: x = -1 x = 1 Program invariant: x

11 Focus on Loop Invariants If we have loop invariants we can get (basically) everything else at little cost - while getting loop invariants requires invention In the following discussion we focus on loop invariants (and call them simply invariants ) This focus is also consistent with the Assertion Inference Paradox 11

12 Focus on Loop Invariants The various kinds of invariants are closely related by the inference rules of Hoare logic If Lx is a location invariant at x Lx is a program invariant If P is a program invariant then it is also a location invariant at every location x If I is a loop invariant of: x: from... until c loop... end then I c is a location invariant at x+1 If L is a location invariant at x+1: x: a := b + 3 then L [b + 3 / a] is a location invariant at x Etc... {P} A {I} {I c} B {I} {P} from A until c loop B end {I c} {P [e / x]} x := e {P} 12

13 Techniques for Invariant Inference Classification of invariant inference techniques: Dynamic techniques Static techniques statistical techniques exact techniques (Roughly) direction of increasing: s o u n d n ess c o m pl e t e n ess m at h e m a t i c a l s o p h is t i c a ti o n

14 Exact Static Techniques for Invariant Inference 14

15 Static Invariant Inference: classification Static exact techniques for invariant inference are further classified in categories: Direct Assertion-based postcondition mutation Based on abstract interpretation Constraint-based - usually, template-based 15

16 Exact Static Techniques for Invariant Inference: Postcondition-mutation Approach 16

17 The Role of User-provided Contracts Techniques for invariant inference rarely take advantage of other annotations in the program text, such as contracts provided by the user - Not every annotation can (or should, cf. Assertion Inference Paradox) be inferred automatically. However, there is a close connection between a loop's invariant and its postcondition 17

18 The Role of User-provided Contracts However, there is a close connection between a loop's invariant and its postcondition Semantically, the invariant is a weakened form of the postcondition - A larger set of program states Example: from x := 0 until x = n loop x := x + 1 end Post: x = n (with n > 0) Invariant: 0 x n Init: x = 0 1 x n... n-1 x n Post: x = n Inv: 0 x n 18

19 Invariants by Postcondition Mutation In a nutshell: Static verification of candidate invariants obtained by mutating postconditions Assume the availability of postconditions Mutate postconditions according to various heuristics - the heuristics mirror common patterns that link postconditions to invariants - each mutated postcondition is a candidate invariant Verify which candidates are indeed invariants - With an automatic program prover such as Boogie Retain all verified invariants 2009 gin-pink DynaMate 19

20 Loop invariant inference Pre Post Routine Input mutate Candidate Invariants Loop checking invariance Loop Invariants proving correctness (possibly using additional info) {Pre} Program Routine {Post} Output 20

21 Maximum value of an array max (A: ARRAY [T] ; n: INTEGER): T require A.length = n 1 local i: INTEGER do from i := 0 ; Result := A[1]; until i = n loop i := i + 1 if Result A[i] then Result := A[i] end end ensure ( 1 j n A[j] Result ) and ( 1 j n A[j] = Result ) 21

22 Maximum value of an array max (A: ARRAY [T] ; n: INTEGER): T require A.length = n 1 ensure ( 1 j n A[j] Result ) and ( 1 j n A[j] = Result ) Constant relaxation: replace constant n by variable i Term dropping: remove second conjunct Invariant: 1 j i A[j] Result 22

23 Maximum value of an array (cont'd) max (A: ARRAY [T] ; n: INTEGER): T require A.length = n 1 ensure ( 1 j n A[j] Result ) and ( 1 j n A[j] = Result ) Term dropping: remove first conjunct Invariant: 1 j n A[j] = Result 23

24 Maximum value of an array (2 nd version) max_v2 (A: ARRAY [T] ; n: INTEGER): T require A.length = n 1 local i: INTEGER do from i := 1 ; Result := A[1]; until i > n loop if Result A[i] then Result := A[i] end i := i + 1 end ensure 1 j n A[j] Result 24

25 Maximum value of an array (2 nd version) max_v2 (A: ARRAY [T] ; n: INTEGER): T require A.length = n 1 ensure 1 j n A[j] Result Constant relaxation: replace constant n by variable i 1 j i A[j] Result Variable aging: use expression representing the previous value of i: i 1 Invariant: 1 j i - 1 A[j] Result 25

26 Postcondition Mutation Heuristics Constant relaxation replace constant by variable Uncoupling - cannot/may be changed by any of the loop bodies replace subexpression appearing twice by two subexpressions - for example: subexpression = variable id Term dropping remove a conjunct Variable aging replace subexpression by another expression representing its previous value 26

27 Invariant Inference: the Algorithm Goal: find invariants of loops in procedure proc For each: post: postcondition clause of proc loop: outer loop in proc compute all mutations M of post w.r.t. loop - considering postcondition clauses separately implements term dropping Result: any formula in M which can be verified as invariant of any loop in proc 27

28 Array Partitioning partition (A: ARRAY [T]; n: INTEGER; pivot: T): INTEGER require A.length = n 1 local l, h: INTEGER do from l := 1 ; h := n until l = h loop from until l = h or A[l] > pivot loop l := l + 1 end from until l = h or pivot > A[h] loop h := h - 1 end A.swap (l, h) end if pivot A[l] then l := l 1 end ; h := l ; Result := h ensure ( 1 k Result A[k] pivot) and ( Result<k n A[k] pivot) 28

29 Array Partitioning partition (A: ARRAY [T]; n: INTEGER; pivot: T): INTEGER require A.length = n 1 ensure ( 1 k Result A[k] pivot) and ( Result<k n A[k] pivot) Uncoupling: replace first occurrence of Result by l and second by h ( 1 k l A[k] pivot) and ( h < k n A[k] pivot) Variable aging: use expression representing the previous value of l: l 1 Invariant: ( 1 k l - 1 A[k] pivot) and ( h < k n A[k] pivot) 29

30 Array Partitioning partition (A: ARRAY [T]; n: INTEGER; pivot: T): INTEGER require A.length = n 1 ensure ( 1 k Result A[k] pivot) and ( Result<k n A[k] pivot) Term dropping: remove first conjunct Result < k n A[k] pivot Constant relaxation: replace constant Result by variable h Invariant: h < k n A[k] pivot 30

31 Postcondition Mutation in DynaMate DynaMate is a tool that combines postcondition mutation with templatebased techniques for invariant inference and with automated testing. It finds loop invariants to verify Java/JML programs. Experiments on 28 methods of java.util: # proved methods % proved proof obligations # invariants post mutations # other invariants time % min. 31

32 Limitations of the approach Some invariants are not mutations of the postcondition completeness of the postcondition integration with other techniques more heuristics Combinatorial explosion predefined mutations, time out Dependencies especially with nested loops dynamic checking Limitations of automated reasoning techniques 32

33 Exact Static Techniques for Invariant Inference: Constraint-based Approach 33

34 Constraint-based Invariant Inference In a nutshell: encode semantics of iteration as constraints on a template invariant Choose a template invariant expression template defines a (infinte) set of assertions Encode the loop semantics as a set of constraints on the template initiation + consecution Solve the constraints this is usually the complex part Any solution is an invariant E.g.: Henny Sipma et al Zohar Manna et al Tom Henzinger et al. 34

35 Constraint-based Inv. Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Template invariant expression: T = c x + d n + e 0 Constraints encoding loop semantics: Initiation: T holds for the initial values of x and n T [0/x; n 0 /n] c 0 + d n 0 + e 0 d n 0 + e 0 35

36 Constraint-based Inv. Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Constraints encoding loop semantics: Consecution: if T holds and one iteration of the loop is executed, T still holds T [x/x; n/n] ( (x n) x' = x + 1 n' = n ) T [x'/x; n'/n] Solving the constraints requires to eliminate occurrences of x, x', n, n' For linear constraints we can use Farkas's Lemma 36

37 Farkas's Lemma (1902) Let S be a system of linear inequalities over n real variables: and let Ψ be a linear inequality: Then S Ψ is valid iff S is unsatisfiable or there exist m +1 real nonnegative coefficients λ 0, λ 1,..., λ m such that: 37

38 Constraint-based Inv. Inference: Example Use Farkas's lemma to turn the consecution constraint: T [x/x; n/n] x < n x' = x + 1 n' = n T [x'/x; n'/n] into a constraint over c, d, and e only. 38

39 Constraint-based Inv. Inference: Example 39

40 Constraint-based Inv. Inference: Example Finally, eliminate existential quantifiers from Φ to get the constraint: c 0 ( c + d = 0 e 0 ) (Quantifier elimination is also quite technical, but there are tools that do that for us) 40

41 Constraint-based Inv. Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Any solution [c, d, e] to: Initiation and Consecution: ( d n 0 + e 0 ) ( c 0 ( c + d = 0 e 0 ) ) determines an invariant of the loop. For example, substituting the following values in the template leads to invariants: - [0, -1, 0] ---> n 0 - [1, 0, 0] ---> x 0 - [1, -1, 0] ---> x n 0 41

42 Constraint-based Inv. Inference: Summary Main issues: - choice of invariant templates for which effective decision procedures exist interesting research topic per se, on the brink of undecidability - heuristics to extract the best invariants from the set of solutions Advantages: - sound & complete (w.r.t. the template) - exploit heterogeneous decision procedures together - fully automated (possibly except for providing the template) providing the template introduces a natural form of user interaction Disadvantages: - suitable mathematical decision theories are usually quite sophisticated hence, hard to extend and customize - exact constraint solving is usually quite expensive - mostly suitable for algebraic/numeric/scalar invariants requires integration with other techniques to achieve full functional correctness proofs 42

43 Dynamic Techniques for Invariant Inference 43

44 Dynamic Invariant Inference In a nutshell: testing of candidate invariants Choose a set of test cases Perform runtime monitoring of candidate invariants If some test run violates a candidate, discard the candidate The surviving candidates are guessed invariant Daikon tool, Mike Ernst et al. CITADEL: Daikon for Eiffel, Nadia Polikarpova AutoInfer for Eiffel (Yi Jason Wei et al.) 44

45 Dynamic Invariant Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Test cases: { n = k 0 k 1000 } Candidate invariants: - { x c c 1000 }, { n c c 1000 } - { x = c n + d -500 c, d 500 } - { x < n, x n, x = n, x n, x n, x > n } - { x ± n c -500 c 500 }

46 Dynamic Invariant Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Survivors (after loop iterations) : - { x -c 0 c 1000 }, { n -c 0 c 1000 } - x n - { x + n c -500 c 500 }

47 Dynamic Invariant Inference: Summary Main issues: - choose suitable test cases - handle huge sets of candidate invariants (runtime overhead) - estimate soundness/quality of survivor predicates - select heuristically the best survivor predicates Advantages: - straightforward to implement (at least compared to other techniques) - guessing is often rather accurate in practice (possibly with some heuristics) - customizable and rather flexible: in principle, whatever you can test you can check for invariance Disadvantages: - unsound (educated guessing) - without heuristics, large amount of useless, redundant predicates - sensitive to choice of test cases - some complex candidate invariants are difficult to implement efficiently 47

48 Exact Static Techniques for Invariant Inference: Direct Approach 48

49 Direct Static Invariant Inference In a nutshell: solve the fixpoint equations underlying the program v(i): value of variable v at step i of the computation Encode the semantics of loops explicitly and directly as recurrence equations over v(i) Solve recurrence equations Eliminate step parameter i to obtain invariant Shmuel Katz & Zohar Manna Laura Kovacs et al. 49

50 Direct Static Invariant Inference: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end x(i), n(i) Recurrence relations: 50

51 Direct Static Invariant Inference: Example Solving recurrence relations: x(i) = min(n 0, i) 0 n(i) = n 0 Eliminating step parameter i: - x(i) n(i) = min(n 0, i) n 0 0, or: - x n 0, hence: - 0 x n 51

52 Direct Static Invariant Inference: Summary Main issues: - in its bare form, more a set of guidelines than a technique - step parameter elimination is tricky Advantages: - since semantics is represented explicitly, obtained invariants are often powerful - benefits from the programmer's ingenuity - additional information about the program can be plugged in Disadvantages: - solving recurrence equations can be very difficult (when possible at all) - typically restricted to algebraic/numeric/scalar invariants 52

53 APPENDIX Additional Material 53

54 Exact Static Techniques for Invariant Inference: Approach Based on Abstract Interpretation 54

55 Abstract Interpretation for Invariants In a nutshell: symbolic execution over an abstract domain with guarantee of termination Consider the over-approximation of the value of variables over some coarse abstract domain (instead of their exact values) Symbolically execute the program over the abstract domain Iterate loops until termination termination guaranteed by the nature of the abstract domain or by heuristic cut-offs (widening) The final expression is an invariant Michael Karr 1977, Patrick & Radhia Cousot, Nicolas Halbwachs 55

56 Abstract Interpretation for Inv.: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Abstract interval domain: conjunction of inequalities in the form v c or c v for any program variable v and integer constant c Initially: S(0) { 0 x, x 0, 0 n } After one loop iteration: S(1) { 1 x, x 1, 0 n } Set of abstract states reached in at most one loop iteration: S(0) S(1) = { 0 x, x 1, 0 n } 56

57 Abstract Interpretation for Inv.: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Initially: S(0) { 0 x, x 0, 0 n } Set of abstract states reached in at most one loop iteration: S(0) S(1) = { 0 x, x 1, 0 n } S(0) S(1) does not subsume S(0) no fixpoint, keep on iterating Abstract states after at most k loop iterations: S(0)... S(k) = { 0 x, x k, 0 n } No convergence as: S(0)... S(k) does not subsume S(0)... S(k-1) 57

58 Abstract Interpretation for Inv.: Example dummy_routine (n: NATURAL) local x: NATURAL do from x := 0 until x n loop x := x + 1 end end Abstract states after at most k loop iterations: S(0)... S(k) = { 0 x, x k, 0 n } Apply heuristic over-approximation: relax S(0)... S(k) by dropping inequalities with growing bounds: S' = widen { 0 x, x k, 0 n } = { 0 x, 0 n } S' is a fixpoint of the loop iteration 0 x 0 n is a loop invariant a very weak one, but more sophisticated choices of abstract domain and/ or heuristic over-approximation would yield the desired 0 x n 58

59 Abstract Interpretation for Inv.: Summary Main issues: - effective choice of abstract domain trade off: accuracy vs. computational efficiency - smart choice of heuristic widening Advantages: - the abstract interpretation framework is quite general and customizable to many different program properties - fully automated - sound - scalable: efficient implementations are possible Disadvantages: - incompleteness, from two sources: invariants can be inexpressible in the abstract domain even if they are expressible, heuristic widening loses completeness - requires integration with other techniques to achieve full functional correctness proofs 59

60 Statistical Static Techniques for Invariant Inference 60

61 Statistical Static Invariant Inference The goal of the analysis is usually different than for other classes of invariant inference techniques: - inferring likely specific behavioral specification (e.g., temporal properties) - inferring likely violations of invariance behavioral properties - no functional invariants... x: create a_node... y: dispose a_node Examples of inferred behavioral specs: Location x performs allocation (A) of some resource Location y performs deallocation (D) of some resource Every allocated resource is eventually deallocated 61

62 Statistical Static Invariant Inference In a nutshell: learning of a statistical model Classify all possible behaviors (w.r.t. goal properties) of code Assign prior probabilities to different behaviors possibly including additional knowledge Compute cumulative probabilities of code e.g., through simple symbolic execution Report likely inferred specifications or likely invariance violations those with the highest cumulative probabilities 2001, Dawson Engler et al James Larus et al

63 Statistical Invariant Inference: Example Prior probabilities: Pr [green] = 0.9 (probability that the sequence is ok) Pr [red] = 0.1 (probability that the sequence gives a bug) Cumulative probabilities, e.g.: Pr [A, D, D] = Π f f (A, D, D) = 0.9 x... x... - f are the various elements of knowledge 63

64 Statistical Invariant Inference: Summary Main issues: - choose suitable behavioral properties - compute efficiently complex products of probabilities for a huge number of candidate behaviors - classify possible behaviors by their probabilities - introduce effective ad hoc factors Advantages: - reasonably robust w.r.t. the choice of prior probabilities - customizable: can incorporate very specific probability factors - can handle large real programs Disadvantages: - unsound - mostly limited to simple behavioral properties - best suited for systems code (where full functional correctness is usually not a concern) 64

### InvGen: An Efficient Invariant Generator

InvGen: An Efficient Invariant Generator Ashutosh Gupta and Andrey Rybalchenko Max Planck Institute for Software Systems (MPI-SWS) Abstract. In this paper we present InvGen, an automatic linear arithmetic

### Rigorous Software Development CSCI-GA 3033-009

Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 11 Semantics of Programming Languages Denotational Semantics Meaning of a program is defined as the mathematical

### Model Checking: An Introduction

Announcements Model Checking: An Introduction Meeting 2 Office hours M 1:30pm-2:30pm W 5:30pm-6:30pm (after class) and by appointment ECOT 621 Moodle problems? Fundamentals of Programming Languages CSCI

### Specification and Analysis of Contracts Lecture 1 Introduction

Specification and Analysis of Contracts Lecture 1 Introduction Gerardo Schneider gerardo@ifi.uio.no http://folk.uio.no/gerardo/ Department of Informatics, University of Oslo SEFM School, Oct. 27 - Nov.

### Static Program Transformations for Efficient Software Model Checking

Static Program Transformations for Efficient Software Model Checking Shobha Vasudevan Jacob Abraham The University of Texas at Austin Dependable Systems Large and complex systems Software faults are major

### Verification of Imperative Programs in Theorema

Verification of Imperative Programs in Theorema Laura Ildikó Kovács, Nikolaj Popov, Tudor Jebelean 1 Research Institute for Symbolic Computation, Johannes Kepler University, A-4040 Linz, Austria Institute

### A Static Analyzer for Large Safety-Critical Software. Considered Programs and Semantics. Automatic Program Verification by Abstract Interpretation

PLDI 03 A Static Analyzer for Large Safety-Critical Software B. Blanchet, P. Cousot, R. Cousot, J. Feret L. Mauborgne, A. Miné, D. Monniaux,. Rival CNRS École normale supérieure École polytechnique Paris

### Formal Verification of Software

Formal Verification of Software Sabine Broda Department of Computer Science/FCUP 12 de Novembro de 2014 Sabine Broda (DCC-FCUP) Formal Verification of Software 12 de Novembro de 2014 1 / 26 Formal Verification

### Sequences and Mathematical Induction. CSE 215, Foundations of Computer Science Stony Brook University

Sequences and Mathematical Induction CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.edu/~cse215 Sequences A sequence is a function whose domain is all the integers

### Global Constraints in Software Testing Applications

Global Constraints in Software Testing Applications Arnaud Gotlieb Simula Research Laboratory Norway 1/34 The Certus Centre Software Validation and Verification Cisco Systems Norway Hosted by SIMULA Established

### Coverability for Parallel Programs

2015 http://excel.fit.vutbr.cz Coverability for Parallel Programs Lenka Turoňová* Abstract We improve existing method for the automatic verification of systems with parallel running processes. The technique

### A simple algorithm with no simple verication

A simple algorithm with no simple verication Laszlo Csirmaz Central European University Abstract The correctness of a simple sorting algorithm is resented, which algorithm is \evidently wrong" at the rst

### Spec #: An Overview. Mohamed Aly, BSc(Eng)

Spec #: An Overview Mohamed Aly, BSc(Eng) Outline Motivation Overview Usage Language Examples References Outline Motivation Overview Usage Language Examples References Motivation - History Software development

### Design by Contract beyond class modelling

Design by Contract beyond class modelling Introduction Design by Contract (DbC) or Programming by Contract is an approach to designing software. It says that designers should define precise and verifiable

### COMP 250 Fall Mathematical induction Sept. 26, (n 1) + n = n + (n 1)

COMP 50 Fall 016 9 - Mathematical induction Sept 6, 016 You will see many examples in this course and upcoming courses of algorithms for solving various problems It many cases, it will be obvious that

### FUZZY CLUSTERING ANALYSIS OF DATA MINING: APPLICATION TO AN ACCIDENT MINING SYSTEM

International Journal of Innovative Computing, Information and Control ICIC International c 0 ISSN 34-48 Volume 8, Number 8, August 0 pp. 4 FUZZY CLUSTERING ANALYSIS OF DATA MINING: APPLICATION TO AN ACCIDENT

### Automated Theorem Proving - summary of lecture 1

Automated Theorem Proving - summary of lecture 1 1 Introduction Automated Theorem Proving (ATP) deals with the development of computer programs that show that some statement is a logical consequence of

### Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers

Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers TIMOTHY S. GEGG-HARRISON Winona State University Although computer scientists understand the importance of discrete

### Section 3 Sequences and Limits

Section 3 Sequences and Limits Definition A sequence of real numbers is an infinite ordered list a, a 2, a 3, a 4,... where, for each n N, a n is a real number. We call a n the n-th term of the sequence.

### Why? A central concept in Computer Science. Algorithms are ubiquitous.

Analysis of Algorithms: A Brief Introduction Why? A central concept in Computer Science. Algorithms are ubiquitous. Using the Internet (sending email, transferring files, use of search engines, online

### MATH 55: HOMEWORK #2 SOLUTIONS

MATH 55: HOMEWORK # SOLUTIONS ERIC PETERSON * 1. SECTION 1.5: NESTED QUANTIFIERS 1.1. Problem 1.5.8. Determine the truth value of each of these statements if the domain of each variable consists of all

### Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications

Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications Sayantan Das Prasenjit Basu Ansuman Banerjee Pallab Dasgupta P.P. Chakrabarti Department of Computer Science & Engineering

### Usable Verification of Object-Oriented Programs by Combining Static and Dynamic Techniques

Usable Verification of Object-Oriented Programs by Combining Static and Dynamic Techniques Julian Tschannen, Carlo A. Furia, Martin Nordio, and Bertrand Meyer Chair of Software Engineering, ETH Zurich,

### PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE

International Journal of Computer ScienceandCommunication Vol. 2, No. 1, January-June2011, pp. 153-157 PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE Neeraj Kumar Singhania University,

### Lecture Notes on Linear Search

Lecture Notes on Linear Search 15-122: Principles of Imperative Computation Frank Pfenning Lecture 5 January 29, 2013 1 Introduction One of the fundamental and recurring problems in computer science is

### Extending Semantic Resolution via Automated Model Building: applications

Extending Semantic Resolution via Automated Model Building: applications Ricardo Caferra Nicolas Peltier LIFIA-IMAG L1F1A-IMAG 46, Avenue Felix Viallet 46, Avenue Felix Viallei 38031 Grenoble Cedex FRANCE

### Clustering and scheduling maintenance tasks over time

Clustering and scheduling maintenance tasks over time Per Kreuger 2008-04-29 SICS Technical Report T2008:09 Abstract We report results on a maintenance scheduling problem. The problem consists of allocating

### Spec# CSE A verifying compiler uses automated reasoning to check the correctness of the program that it compiles.

Spec# CSE 6323 The Verifying Compiler A verifying compiler uses automated reasoning to check the correctness of the program that it compiles. Correctness is specified by types, assertions,.. and other

### Fundamentals of Mathematics Lecture 6: Propositional Logic

Fundamentals of Mathematics Lecture 6: Propositional Logic Guan-Shieng Huang National Chi Nan University, Taiwan Spring, 2008 1 / 39 Connectives Propositional Connectives I 1 Negation: (not A) A A T F

### Tool-Assisted Unit-Test Generation and Selection Based on Operational Abstractions

Tool-Assisted Unit-Test Generation and Selection Based on Operational Abstractions Tao Xie 1 and David Notkin 2 (xie@csc.ncsu.edu,notkin@cs.washington.edu) 1 Department of Computer Science, North Carolina

### MATHEMATICAL INDUCTION AND DIFFERENCE EQUATIONS

1 CHAPTER 6. MATHEMATICAL INDUCTION AND DIFFERENCE EQUATIONS 1 INSTITIÚID TEICNEOLAÍOCHTA CHEATHARLACH INSTITUTE OF TECHNOLOGY CARLOW MATHEMATICAL INDUCTION AND DIFFERENCE EQUATIONS 1 Introduction Recurrence

### Mathematics for Computer Science/Software Engineering. Notes for the course MSM1F3 Dr. R. A. Wilson

Mathematics for Computer Science/Software Engineering Notes for the course MSM1F3 Dr. R. A. Wilson October 1996 Chapter 1 Logic Lecture no. 1. We introduce the concept of a proposition, which is a statement

### Automated Detection of Non-Termination and NullPointerExceptions for Java Bytecode

Automated Detection of Non-Termination and NullPointerExceptions for Java Bytecode Marc Brockschmidt, Thomas Ströder, Carsten Otto, and Jürgen Giesl LuFG Informatik 2, RWTH Aachen University, Germany Abstract.

### Boogie: A Modular Reusable Verifier for Object-Oriented Programs

Boogie: A Modular Reusable Verifier for Object-Oriented Programs M. Barnett, B.E. Chang, R. DeLine, B. Jacobs, K.R.M. Leino Lorenzo Baesso ETH Zurich Motivation Abstract Domains Modular Architecture Automatic

### 3 Does the Simplex Algorithm Work?

Does the Simplex Algorithm Work? In this section we carefully examine the simplex algorithm introduced in the previous chapter. Our goal is to either prove that it works, or to determine those circumstances

### Context-Bounded Model Checking of LTL Properties for ANSI-C Software. Jeremy Morse, Lucas Cordeiro, Bernd Fischer, Denis Nicole

Context-Bounded Model Checking of LTL Properties for ANSI-C Software Jeremy Morse, Lucas Cordeiro, Bernd Fischer, Denis Nicole Model Checking C Model checking: normally applied to formal state transition

### CHAPTER 7 GENERAL PROOF SYSTEMS

CHAPTER 7 GENERAL PROOF SYSTEMS 1 Introduction Proof systems are built to prove statements. They can be thought as an inference machine with special statements, called provable statements, or sometimes

### Software Testing & Analysis (F22ST3): Static Analysis Techniques 2. Andrew Ireland

Software Testing & Analysis (F22ST3) Static Analysis Techniques Andrew Ireland School of Mathematical and Computer Science Heriot-Watt University Edinburgh Software Testing & Analysis (F22ST3): Static

### Transformation Techniques for Constraint Logic Programs with Applications to Protocol Verification

UNIVERSITÀ DEGLI STUDI DI ROMA TOR VERGATA FACOLTÀ DI INGEGNERIA DOTTORATO DI RICERCA IN INFORMATICA ED INGEGNERIA DELL AUTOMAZIONE XX CICLO Transformation Techniques for Constraint Logic Programs with

### 1. R In this and the next section we are going to study the properties of sequences of real numbers.

+a 1. R In this and the next section we are going to study the properties of sequences of real numbers. Definition 1.1. (Sequence) A sequence is a function with domain N. Example 1.2. A sequence of real

### Software Engineering

Software Engineering Lecture 04: The B Specification Method Peter Thiemann University of Freiburg, Germany SS 2013 Peter Thiemann (Univ. Freiburg) Software Engineering SWT 1 / 50 The B specification method

### A Case for Static Analyzers in the Cloud (Position paper)

A Case for Static Analyzers in the Cloud (Position paper) Michael Barnett 1 Mehdi Bouaziz 2 Manuel Fähndrich 1 Francesco Logozzo 1 1 Microsoft Research, Redmond, WA (USA) 2 École normale supérieure, Paris

### Threader: A Constraint-based Verifier for Multi-Threaded Programs

Threader: A Constraint-based Verifier for Multi-Threaded Programs Ashutosh Gupta, Corneliu Popeea, and Andrey Rybalchenko Technische Universität München Abstract. We present a tool that implements Owicki-Gries

### 3 Extending the Refinement Calculus

Building BSP Programs Using the Refinement Calculus D.B. Skillicorn? Department of Computing and Information Science Queen s University, Kingston, Canada skill@qucis.queensu.ca Abstract. We extend the

### Applied Algorithm Design Lecture 5

Applied Algorithm Design Lecture 5 Pietro Michiardi Eurecom Pietro Michiardi (Eurecom) Applied Algorithm Design Lecture 5 1 / 86 Approximation Algorithms Pietro Michiardi (Eurecom) Applied Algorithm Design

### ON FUNCTIONAL SYMBOL-FREE LOGIC PROGRAMS

PROCEEDINGS OF THE YEREVAN STATE UNIVERSITY Physical and Mathematical Sciences 2012 1 p. 43 48 ON FUNCTIONAL SYMBOL-FREE LOGIC PROGRAMS I nf or m at i cs L. A. HAYKAZYAN * Chair of Programming and Information

### Problem Set 1: Program Verification

Problem Set 1: Program Verification CS 173 Honors Section Assigned: September 7, 2011 Due on: September 14, 2011 One of the applications of logic in computer science is its use in proving programs to be

### CS/COE 1501 http://cs.pitt.edu/~bill/1501/

CS/COE 1501 http://cs.pitt.edu/~bill/1501/ Lecture 01 Course Introduction Meta-notes These notes are intended for use by students in CS1501 at the University of Pittsburgh. They are provided free of charge

### Recurrence Relations

Recurrence Relations Introduction Determining the running time of a recursive algorithm often requires one to determine the big-o growth of a function T (n) that is defined in terms of a recurrence relation.

### MAT-71506 Program Verication: Exercises

MAT-71506 Program Verication: Exercises Antero Kangas Tampere University of Technology Department of Mathematics September 11, 2014 Accomplishment Exercises are obligatory and probably the grades will

### Software Engineering Techniques

Software Engineering Techniques Low level design issues for programming-in-the-large. Software Quality Design by contract Pre- and post conditions Class invariants Ten do Ten do nots Another type of summary

### A Framework for the Semantics of Behavioral Contracts

A Framework for the Semantics of Behavioral Contracts Ashley McNeile Metamaxim Ltd, 48 Brunswick Gardens, London W8 4AN, UK ashley.mcneile@metamaxim.com Abstract. Contracts have proved a powerful concept

### 8.1 Makespan Scheduling

600.469 / 600.669 Approximation Algorithms Lecturer: Michael Dinitz Topic: Dynamic Programing: Min-Makespan and Bin Packing Date: 2/19/15 Scribe: Gabriel Kaptchuk 8.1 Makespan Scheduling Consider an instance

### Discrete Mathematics, Chapter : Predicate Logic

Discrete Mathematics, Chapter 1.4-1.5: Predicate Logic Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 1.4-1.5 1 / 23 Outline 1 Predicates

### Math 55: Discrete Mathematics

Math 55: Discrete Mathematics UC Berkeley, Fall 2011 Homework # 5, due Wednesday, February 22 5.1.4 Let P (n) be the statement that 1 3 + 2 3 + + n 3 = (n(n + 1)/2) 2 for the positive integer n. a) What

### 2.4 Mathematical Induction

2.4 Mathematical Induction What Is (Weak) Induction? The Principle of Mathematical Induction works like this: What Is (Weak) Induction? The Principle of Mathematical Induction works like this: We want

### Foundational Proof Certificates

An application of proof theory to computer science INRIA-Saclay & LIX, École Polytechnique CUSO Winter School, Proof and Computation 30 January 2013 Can we standardize, communicate, and trust formal proofs?

### StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java

StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java Jesús Mauricio Chimento 1, Wolfgang Ahrendt 1, Gordon J. Pace 2, and Gerardo Schneider 3 1 Chalmers University of Technology, Sweden.

### Quadratic Equations and Inequalities

MA 134 Lecture Notes August 20, 2012 Introduction The purpose of this lecture is to... Introduction The purpose of this lecture is to... Learn about different types of equations Introduction The purpose

### Rigorous. Development. Software. Program Verification. & Springer. An Introduction to. Jorge Sousa Pinto. Jose Bacelar Almeida Maria Joao Frade

Jose Bacelar Almeida Maria Joao Frade Jorge Sousa Pinto Simao Melo de Sousa Rigorous Software Development An Introduction to Program Verification & Springer Contents 1 Introduction 1 1.1 A Formal Approach

### Extended Static Checking for Java

Lukas TU München - Seminar Verification 14. Juli 2011 Outline 1 Motivation 2 ESC/Java example 3 ESC/JAVA architecture VC generator Simplify 4 JML + ESC/Java annotation language JML What ESC/Java checks

### CS420/520 Algorithm Analysis Spring 2010 Lecture 04

CS420/520 Algorithm Analysis Spring 2010 Lecture 04 I. Chapter 4 Recurrences A. Introduction 1. Three steps applied at each level of a recursion a) Divide into a number of subproblems that are smaller

### OpenACC 2.0 and the PGI Accelerator Compilers

OpenACC 2.0 and the PGI Accelerator Compilers Michael Wolfe The Portland Group michael.wolfe@pgroup.com This presentation discusses the additions made to the OpenACC API in Version 2.0. I will also present

### Induction. Mathematical Induction. Induction. Induction. Induction. Induction. 29 Sept 2015

Mathematical If we have a propositional function P(n), and we want to prove that P(n) is true for any natural number n, we do the following: Show that P(0) is true. (basis step) We could also start at

### CS510 Software Engineering

CS510 Software Engineering Propositional Logic Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Scott A. Carr Slides inspired by Xiangyu Zhang http://nebelwelt.net/teaching/15-cs510-se

### Towards the Industrial Scale Development of Custom Static Analyzers

Towards the Industrial Scale Development of Custom Static Analyzers John Anton, Eric Bush, Allen Goldberg, Klaus Havelund, Doug Smith, Arnaud Venet Kestrel Technology LLC 4984 El Camino Real #230 Los Altos,

### 1 Limiting distribution for a Markov chain

Copyright c 2009 by Karl Sigman Limiting distribution for a Markov chain In these Lecture Notes, we shall study the limiting behavior of Markov chains as time n In particular, under suitable easy-to-check

### Language-Independent Model Transformation Verification K. Lano, S. Kolahdouz-Rahimi, T. Clark King s College London; University of Middlesex

Language-Independent Model Transformation Verification K. Lano, S. Kolahdouz-Rahimi, T. Clark King s College London; University of Middlesex 1 Language-independent MT verification One hinderance to MT

### 2. Methods of Proof Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try.

2. METHODS OF PROOF 69 2. Methods of Proof 2.1. Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try. Trivial Proof: If we know q is true then

### Introduction to Static Analysis for Assurance

Introduction to Static Analysis for Assurance John Rushby Computer Science Laboratory SRI International Menlo Park CA USA John Rushby Static Analysis for Assurance: 1 Overview What is static analysis?

### Software Testing & Verification 2013/2014 Universiteit Utrecht

Software Testing & Verification 2013/2014 Universiteit Utrecht 2nd Jul. 2014, 13:30-16:30, BBL 001 Lecturer: Wishnu Prasetya You are allowed to bring along the Appendix of the LN. Part I [3pt (6 0.5)]

### Induction and Recursion

Induction and Recursion Winter 2010 Mathematical Induction Mathematical Induction Principle (of Mathematical Induction) Suppose you want to prove that a statement about an integer n is true for every positive

### Simple Loop Patterns and Rich Loop Invariants

Simple Loop Patterns and Rich Loop Invariants Marc Sango AdaCore CNAM 05-10-2011 Marc Sango (AdaCore CNAM) Simple Loop Patterns and Rich Loop Invariants 05-10-2011 1 / 17 Contents 1 Motivation 2 Principle

### Summary Last Lecture. Automated Reasoning. Outline of the Lecture. Definition sequent calculus. Theorem (Normalisation and Strong Normalisation)

Summary Summary Last Lecture sequent calculus Automated Reasoning Georg Moser Institute of Computer Science @ UIBK Winter 013 (Normalisation and Strong Normalisation) let Π be a proof in minimal logic

### Rigorous Software Engineering Hoare Logic and Design by Contracts

Rigorous Software Engineering Hoare Logic and Design by Contracts Simão Melo de Sousa RELEASE (UBI), LIACC (Porto) Computer Science Department University of Beira Interior, Portugal 2010-2011 S. Melo de

### What is Artificial Intelligence?

Introduction to Artificial Intelligence What is Artificial Intelligence? One definition: AI is the study of how to make computers do things that people generally do better Many approaches and issues, e.g.:

### Software Modeling and Verification

Software Modeling and Verification Alessandro Aldini DiSBeF - Sezione STI University of Urbino Carlo Bo Italy 3-4 February 2015 Algorithmic verification Correctness problem Is the software/hardware system

### Logic and Proofs. Chapter 1

Section 1.0 1.0.1 Chapter 1 Logic and Proofs 1.1 Propositional Logic 1.2 Propositional Equivalences 1.3 Predicates and Quantifiers 1.4 Nested Quantifiers 1.5 Rules of Inference 1.6 Introduction to Proofs

### 11-QA 1 11-QA. Increased cost to distribute modifications Technical reviews. Increased customer support Document reviews

Software Qualities Quality Assurance Maintainer Go Documentation Readable Ce Go Design Functionality Ease of use Ease of learning User Reliability Correctness Efficiency Low Cost Portability Increased

### CS 4310 HOMEWORK SET 1

CS 4310 HOMEWORK SET 1 PAUL MILLER Section 2.1 Exercises Exercise 2.1-1. Using Figure 2.2 as a model, illustrate the operation of INSERTION-SORT on the array A = 31, 41, 59, 26, 41, 58. Solution: Assume

### Lecture 5: Specifying Java Programs

Lecture 5: Specifying Java Programs This lecture aims to:! Introduce the basic ingredients of a program specification.! Show how to map Object-Z specifications into program specifications! Define reasoning

### Merge Sort and Recurrences. COSC 581, Algorithms January 14, 2014

Merge Sort and Recurrences COSC 581, Algorithms January 14, 2014 Reading Assignments Today s class: Chapter 2, 4.0, 4.4 Reading assignment for next class: Chapter 4.2, 4.5 3 Common Algorithmic Techniques

### CS2223 Algorithms B Term 2013 Exam 2 Solutions

CS2223 Algorithms B Term 2013 Exam 2 Solutions Dec. 3, 2013 By Prof. Carolina Ruiz Dept. of Computer Science WPI PROBLEM 1: Solving Recurrences (15 points) Solve the recurrence T (n) = 2T (n/3) + n using

### Chapter 6: Episode discovery process

Chapter 6: Episode discovery process Algorithmic Methods of Data Mining, Fall 2005, Chapter 6: Episode discovery process 1 6. Episode discovery process The knowledge discovery process KDD process of analyzing

### Vers l analyse statique de programmes numériques

Vers l analyse statique de programmes numériques Sylvie Putot Laboratoire de Modélisation et Analyse de Systèmes en Interaction, CEA LIST Journées du GDR et réseau Calcul, 9-10 novembre 2010 Sylvie Putot

### Monitoring Metric First-order Temporal Properties

Monitoring Metric First-order Temporal Properties DAVID BASIN, FELIX KLAEDTKE, SAMUEL MÜLLER, and EUGEN ZĂLINESCU, ETH Zurich Runtime monitoring is a general approach to verifying system properties at

### Predicate Logic. Example: All men are mortal. Socrates is a man. Socrates is mortal.

Predicate Logic Example: All men are mortal. Socrates is a man. Socrates is mortal. Note: We need logic laws that work for statements involving quantities like some and all. In English, the predicate is

### Modern Optimization Methods for Big Data Problems MATH11146 The University of Edinburgh

Modern Optimization Methods for Big Data Problems MATH11146 The University of Edinburgh Peter Richtárik Week 3 Randomized Coordinate Descent With Arbitrary Sampling January 27, 2016 1 / 30 The Problem

### Information Theory and Coding Prof. S. N. Merchant Department of Electrical Engineering Indian Institute of Technology, Bombay

Information Theory and Coding Prof. S. N. Merchant Department of Electrical Engineering Indian Institute of Technology, Bombay Lecture - 17 Shannon-Fano-Elias Coding and Introduction to Arithmetic Coding

### It is not immediately obvious that this should even give an integer. Since 1 < 1 5

Math 163 - Introductory Seminar Lehigh University Spring 8 Notes on Fibonacci numbers, binomial coefficients and mathematical induction These are mostly notes from a previous class and thus include some

### Towards practical reactive security audit using extended static checkers 1

Towards practical reactive security audit using extended static checkers 1 Julien Vanegue 1 Shuvendu K. Lahiri 2 1 Bloomberg LP, New York 2 Microsoft Research, Redmond May 20, 2013 1 The work was conducted

### Aperiodic Task Scheduling

Aperiodic Task Scheduling Jian-Jia Chen (slides are based on Peter Marwedel) TU Dortmund, Informatik 12 Germany Springer, 2010 2014 年 11 月 19 日 These slides use Microsoft clip arts. Microsoft copyright

### Termination Checking: Comparing Structural Recursion and Sized Types by Examples

Termination Checking: Comparing Structural Recursion and Sized Types by Examples David Thibodeau Decemer 3, 2011 Abstract Termination is an important property for programs and is necessary for formal proofs

### Linear Programming Notes V Problem Transformations

Linear Programming Notes V Problem Transformations 1 Introduction Any linear programming problem can be rewritten in either of two standard forms. In the first form, the objective is to maximize, the material

### 24. The Branch and Bound Method

24. The Branch and Bound Method It has serious practical consequences if it is known that a combinatorial problem is NP-complete. Then one can conclude according to the present state of science that no

### Automatic Verification by Abstract Interpretation

Automatic Verification by Abstract Interpretation (Invited tutorial) Patrick Cousot École normale supérieure, Département d informatique, 45 rue d Ulm, 75230 Paris cedex 05, France Patrick.Cousot@ens.fr

### Math 407A: Linear Optimization

Math 407A: Linear Optimization Lecture 4: LP Standard Form 1 1 Author: James Burke, University of Washington LPs in Standard Form Minimization maximization Linear equations to linear inequalities Lower

### Software Verification and Testing. Lecture Notes: Temporal Logics

Software Verification and Testing Lecture Notes: Temporal Logics Motivation traditional programs (whether terminating or non-terminating) can be modelled as relations are analysed wrt their input/output