1. Rahul Sharma and Alex Aiken (Stanford University) 1

2. x = i; y = j; while y!=0 do x = x-1; y = y-1; if( i==j ) assert x==0 2

3. NumericalArrays Heap Strings PLDI08-1 PLDI08-2 PLDI08-3 PLDI08-4 synergy-1 synergy-2 TACAS06 NECLA-1 NECLA-2 NECLA-3 SVCOMP-1 SVCOMP-2 SVCOMP-3 SVCOMP-4 monniaux nested init init-nc init-p init-e 2darray copy copy-p copy-o reverse swap d-swap strcpy strlen memcpy find find-n append merge alloc-f alloc-nf delete delete-all find filter last reverse length replace index substring 3

4. assume P while B do S assert Q Find a valuation of unknown predicates that makes the verification conditions (VCs) valid 4

5. Is it possible to have a general search procedure? 5

6.  (Domain-specific) Checker + (General) Search = Inference  To obtain an invariant inference engine  Instantiate the search with a search space  An SMT solver to check 6

7.  A generally applicable randomized search  Numerical, array, linked lists, and strings  Competitive performance with specialized approaches 7

8.  Markov Chain Monte Carlo (MCMC) sampling  The only known tractable solution method for high dimensional irregular search spaces [andrieu 03][chenney 00] 8

9. 9 73 47 42 29 37 17 23

10. 10

11. 11

12. I gb s t Efficient to evaluate Incremental feedback 12

13. 13

14. 14

15. 15

16. 16

17. 17

18. 18

19. 19

20.  Operations that intermix strings and integers  length(s), indexOf(s1, s2), substr(s1, i1, i2), …  Search space: Boolean combinations of predicates  Z3-Str (FSE’13) for check 20

21.  Static invariant inference is a hard problem, made easier by separating search and check  Search based techniques can work  Competitive with other methods  Easier to retarget to new domains  Future work, scale MCMC to full program proofs 21

22.  Pranav Garg, Christof Löding, P. Madhusudan, Daniel Neider: ICE: A Robust Framework for Learning Invariants. CAV 2014  Shachar Itzhaky, Nikolaj Bjørner, Thomas W. Reps, Mooly Sagiv, Aditya V. Thakur: Property-Directed Shape Analysis. CAV 2014  Rajeev Alur, Rastislav Bodík, Garvit Juniwal, Milo M. K. Martin, Mukund Raghothaman, Sanjit A. Seshia, Rishabh Singh, Armando Solar-Lezama, Emina Torlak, Abhishek Udupa: Syntax-guided synthesis. FMCAD 2013  Ashutosh Gupta, Rupak Majumdar, Andrey Rybalchenko: From tests to proofs. STTT 15(4) (2013)  Yungbum Jung, Soonho Kong, Bow-Yaw Wang, Kwangkeun Yi: Deriving Invariants by Algorithmic Learning, Decision Procedures, and Predicate Abstraction. VMCAI 2010  Sumit Gulwani, Nebojsa Jojic: Program verification as probabilistic inference. POPL 2007: 277-289 22