1. COURSE INTRODUCTION CS703 – Program verification and synthesis Loris D’Antoni

2. Introduce yourself Name What year Who do you work with What do you work on Any hobby Example: Hi everyone, I’m Loris D’Antoni, I’m a new professor here at UW (just came from UPenn). I work with many people and I do research in programming languages and formal methods. Among other things I like biking, playing volleyball, and performing magic tricks. 2

3. Logistics: Course structure Two parts: 1. Program verification (established topic) 2. Program synthesis (new topic and recent papers) For every lecture I will assign material to read before the lecture I will present the material in class and we will discuss it together 3

4. Logistics: What do you have to do? 30% : HW assignments – there will be 3-4 problem sets 40% : Research project 10% : Paper reviews (only for second part of course) 10% : Class participation 10% : Project presentation 4

5. Logistics: Homework Assignments On paper (please type them so I can read them) Have to be done individually Submission details Send me an email with the solution Due the midnight on the posted due date Late penalty 10% of grade each day up to 4 days max 5

6. Logistics: Project Most important part of the course Teams of 1 or 2 people Expectations commensurate with size of team Deliverables Oct 2: Email me a list of 3 project ideas Oct 16: Project proposal Nov 1: Description of progress 1 Nov 22: Description of progress 2 Dec 7-14:Presentation to the class Dec 15:Final write-up 6

7. Logistics: What project to choose? Something that excites you! A theoretical problem (related to formal methods) Extend one of the models we study Synthesize some programming task Apply the concepts learnt in class to a new domain Something you can show to other people later and brag about! If the project is good and new we can turn it into a research paper! 7

8. Logistics: When and Where Lecture: M-W 10.30-12 (ENGR 2345) Do you have any conflicts? Question: Friday and shorter semester? Office hours: Thursdays 10.30-12 but in general just email me Questions about HW assignments, project, material Course website pages.cs.wisc.edu/~loris/cs703.html I might setup something for paper reviews 8

9. WHAT IS THIS COURSE ABOUT? 9

10. 10 Credit: S. A. Seshia Ariane disaster, 1996 $500 million software failure FDIV error, 1994 $500 million Estimated worst-case worm cost: > $50 billion Bugs cost Time, Money, Lives, …

11. Solutions 11 Program verification Does my program do what it is supposed to do? Program synthesis Can you generate a program that does what I have in mind and does not contain bugs?

12. PROGRAM VERIFICATION IN 4 SLIDES 12

13. What is program verification? 13 Program Property No null pointer exception is ever triggered Verifier YES Proof NO Counterexample InputOutput UNDECIDABLE

14. Are we screwed? Even the “easiest” verification problem is NP-Complete (SAT) 14

15. Never give up 15

16. Reasons behind success 16 Wonderful theory Engineering efforts Domain- specific knowledge We’ll see some in this class Programming device drivers Malware fingerprinting XML querying Router filtering Security protocols String encoding SAT solvers SMT solvers… Microsoft…

17. PROGRAM SYNTHESIS 17

18. What is program synthesis? 18

19. When someone says "I want a programming language in which I need only say what I wish done," give him a lollipop. -Allan Perlis 1982 What is software synthesis

20. What is program synthesis? 20 User intent Domain knowledge Program can only use: Length(x), if(x)then y else z, x[i],… Synthesizer Input Output Program 1 -> 0 340 -> 300 568 -> 500 Function f(x){ If(length(x)<3) return 0 Else return x[0]+`00’ } EVEN MORE UNDECIDABLE

21. Never give up Automatic program repair [Kuncak+10] Parsers from examples [Lerner15] Network updates from specification [Cerny+15] Biological models from mutations [Bodik+13] Automatic feedback for programming assignments [Singh+14] Automatic feedback for programming assignments FlashFill video [Gulwani11] FlashFill video 21

22. 22

23. Synthesis of AMBA AHB from Formal Spec AMBA: Advanced Microcontroller Bus Architecture AMBA AHB: a high-performance system backbone bus Formal Spec written in LTL Circuit automatically synthesized! AHB Slave synthesized in 13 second, (has 276 gates with area 545 square units)

24. FlashFill: a feature of Excel 2013 (Sumit Gulwani et al.)

26. Real world application of synthesis

27. A BIT ABOUT MY RESEARCH 27

28. Verify string encoders 28 [VMCAI13, CAV14, FMSD15] BASE64 Encoder BASE64 Decoder Bex: a programming language in which this property can be checked automatically = o Identity

29. Check properties of tree transformations 29 Input is tree of positive numbers Output is a tree of odd numbers Pre-conditionPost-conditionTree transformations [PLDI14, TOPLAS15] filter_evmap_inc FAST: a programming language in which these properties can be checked automatically

30. Tagger interference 30 Room Floor Wall Table Chair …. Chair …. Automatic verification of non-interference

31. Verification of Kinect animations 31 Verification questions: Can this sequence of moves result in an unsafe position?

32. Synthesis via crowdsourcing 32 Shuffle / Mutate Refine training set Assess fitness Select successfu l candidate s Specification CrowdBoost Initial Examples + - + - + -

33. Synthesis to generate grades and feedback for undergraduate assignments Your automaton accepts the language { s | ‘ab’ appears in s at least 2 times } Grade: 6/10 33