1. K. Rustan M. Leino Research in Software Engineering (RiSE) Microsoft Research, Redmond, WA, USA Invited talk Informatics Education in Europe (IEE III’08) Venice, Italy 4 Dec 2008

2. Spec# developed jointly with many others, including: Mike Barnett Manuel Fähndrich Peter Müller Wolfram Schulte Herman Venter Educational hints from: Rosemary Monahan

3. Safety critical software No crashes Security issues Time to market Program maintenance Testing is expensive, too

4. Constantly wonder: What am I assuming here? Am I documenting this assumption? How can I mentally convince myself that my program is correct? How can I ask tools for help?

5. Instant feedback to hammer home concepts and check understanding Lack of connection between theory (paper homework) and practice (sitting at a terminal)

6. Hoare triple: { P } S { Q } Postcondition Program Precondition Started in any state satisfying P, the program S does not crash and terminates in a state satisfying Q

7. { x+1 < 100 } x := x + 1 { x < 100 } { P } if B then S else T { Q } follows from: { P  B } S { Q }and { P  ¬ B } T { Q } { P } while B do S { Q } follows from: P  J { J  B } S { J } J  ¬ B  Q

10. Spec# language Object-oriented.NET language Superset of C# 2.0, adding: more types (e.g., non-null types) specifications (e.g., pre- and postconditions) Usage rules (methodology) Checking: Static type checking Run-time checking Static verification (optional)

11. Inc Swap BinarySearch Sum Append Schorr-Waite Assume

12. .NET CodeContract library (.NET 4.0) Clousot abstract interpreter for.NET PEX testing tool for.NET Java+JML Eiffel Krakatoa/Caduceus/Why Boogie Dafny

13. Teach specification and verification Use tools Try things out before giving assignments http://research.microsoft.com/specsharp http://research.microsoft.com/rise

14. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.