1. Victor Kuliamin Institute for System Programming Russian Academy of Sciences Moscow

2.  Growth of software complexity  Degradation of software quality 2/34 SYRCoSE 2009, May 28 Bugs per 1000 LOC

3. Checking consistency between different development artifacts, relevant standards, and between them all and real system operation 3/34 SYRCoSE 2009, May 28 DesignSource Code System Operation Requirements Development Processes Standards and Rules

4.  Review (inspection)  Static analysis  Correctness rules checking  Bug search  Dynamic analysis  Monitoring  Testing  Formal methods  Theorem proving  Model checking 4/34 SYRCoSE 2009, May 28

5.  Static analysis  Dynamic analysis 5/34 SYRCoSE 2009, May 28 Requirements & Rules Source Code Analysis Tool System Operation   Requirements & Rules Monitoring Environment   Users Test Generation

6.  Theorem proving [R. Floyd 1967, C. A. R. Hoare 1969]  Hoare logic – {Pre} Program {Post}  Inference rules  Model checking [E. M. Clarke & E. A. Emerson 1980, J. P. Queille & J. Sifakis 1982]  Analysis of reachable states 6/34 SYRCoSE 2009, May 28

7.  Model based testing  Extended static analysis  Runtime verification  Compound structured testing  Auxiliary  Symbolic execution  Abstract interpretation  Constraint inference  Constraint resolution 7/34 SYRCoSE 2009, May 28 Formal models Testing Static analysis Monitoring

8. [J. C. King, L. A. Clark 1976] 8/34 SYRCoSE 2009, May 28 if(x > 0) { y := x+2; } else if(x > -1) { y := x+1; } else { y := x; } [(x > 0)  (y = x+2)] & [(x ≤ 0 & x > - 1)  (y = x+1)] & [[(x ≤ - 1)  (y = x) ]

9. [P. Cousot & R. Cousot 1977]  Abstract Domains  Octagons  x  y ≤ a  Polyhedra  Heap structures  Bit vectors …… 9/34 SYRCoSE 2009, May 28... while ( (x == 0) && (2*f(x) <= z+g(y/2.5)) ) {... x++; }... while ( B ) {... B = false; }...

10.  Daikon1999MIT M. D. Ernst http://groups.csail.mit.edu/pag/daikon/  =, ≠, <, ≤, ax + by + cz + d = 0, x = y 2, x % y = 0  , , , , A  B= , subsequence, no duplicates, reverse  Houdini2001Flanagan, Leino  DIDUCE2002Stanford University  Agitator2003Agitar  DySy2007Tillmann, Csallner, Smaragdakis 10/34 SYRCoSE 2009, May 28

11. SAT solvers – DPLL algorithm 1962 SMT solvers – Satisfiability modulo Theory  CVC2002Stanford D. L. Dill, C. W. Barrett, A. Stump  Yices2005SRI International B. Dutertre, L. de Moura  Z32006Microsoft Research L. de Moura, N. S. Bjørner 11/34 SYRCoSE 2009, May 28 SMT-LIB http://combination.cs.uiowa.edu/smtlib/

12.  Model based testing  Extended static analysis  Runtime verification  Compound structured testing 12/34 SYRCoSE 2009, May 28

13. 13/34 SYRCoSE 2009, May 28 State model and oracle State model System under test Behavior model Test action generator Adequacy metric 12% Adequacy criteria 36%57%87% FSM-based testing [F. C. Hennie 1964, M. P. Wasilevsky 1973]

14.  Automata (FSM, LTS, ASM)  TGV1997INRIA T. Jéron et al. http://www.inrialpes.fr/vasy/cadp/man/tgv.html  TorX1999University of Twente J. Tretmans et al. http://fmt.cs.utwente.nl/tools/torx/introduction.html  Gotcha-TCBeans1999IBM Research A. Hartman et al.  Automata + Software Contracts  UniTESK2000ISP RAS A. Petrenko et al. http://www.unitesk.com  SpecExplorer2004Microsoft Research W. Schulte et al. + symbolic execution http://research.microsoft.com/en-us/projects/SpecExplorer/ 14/34 SYRCoSE 2009, May 28

15.  ModelJUnit2004Waikato University M. Utting et al. http://czt.sourceforge.net/modeljunit/index.html  NModel2007Univ. of Washington Microsoft Research J. Jacky, M. Veanes et al. http://nmodel.codeplex.com/ 15/34 SYRCoSE 2009, May 28

16. namespace ClientServer { [Feature] public partial class Server { public static Socket serverSocket = Socket.None; public static Phase phase = Phase.Send; public static bool ServerSocketEnabled() { return (serverSocket == Socket.None); } [Action] public static void ServerSocket() { serverSocket = Socket.Created; } public static bool ServerBindEnabled() { return (serverSocket == Socket.Created); } [Action] public static void ServerBind() { serverSocket = Socket.Bound; } public static bool ServerListenEnabled() { return (serverSocket == Socket.Bound); } [Action] public static void ServerListen() { serverSocket = Socket.Listening; } public static bool ServerAcceptEnabled() { return (serverSocket == Socket.Listening); } [Action] public static void ServerAccept() { serverSocket = Socket.Connected; } public static bool ServerReceiveEnabled() { return (serverSocket == Socket.Connected && phase == Phase.ServerReceive); } [Action] public static void ServerReceive() { phase = Phase.Send; } } 16/34 SYRCoSE 2009, May 28

17. 17/34 SYRCoSE 2009, May 28 [Feature] public partial class Client { public static Socket clientSocket = Socket.None; public static double clientBuffer = double.MaxValue; public static bool ClientSocketEnabled() { return (clientSocket == Socket.None); } [Action] public static void ClientSocket() { clientSocket = Socket.Created; } public static bool ClientConnectEnabled() { return (clientSocket == Socket.Created); } [Action] public static void ClientConnect() { clientSocket = Socket.Connecting; } public static bool ClientSendEnabled() { return (clientSocket == Socket.Connected); } [Action] public static void ClientSend() { phase = Phase.ServerReceive; } public static bool ClientReceiveEnabled() { return (clientSocket == Socket.Connected); } [Action] public static double ClientReceive(double datum) { clientBuffer = datum; return datum; } public static bool ClientCloseEnabled() { return (clientSocket == Socket.Created || clientSocket == Socket.Connected); } [Action] public static void ClientClose() { clientSocket = Socket.Closed; } }

18. 18/34 SYRCoSE 2009, May 28 [Feature] public partial class Server { public static bool ClientConnectEnabled() { return (serverSocket == Socket.Listening); } public static bool ClientSendEnabled() { return (phase == Phase.Send); } [Action] public static void ClientSend() { phase = Phase.ServerReceive; } public static bool ClientReceiveEnabled() { return (phase == Phase.ClientReceive); } [Action] public static void ClientReceive() { phase = Phase.Send; } } [Feature] class Values2 { readonly static Set Values = new Set (99.9, 100.0); [Action] static void ClientReceive([Domain("Values")] double datum) {} }

19. 19/34 SYRCoSE 2009, May 28 [Feature] public partial class Client { public static bool ServerAcceptEnabled() { return (clientSocket == Socket.Connecting); } [Action] public static void ServerAccept() { clientSocket = Socket.Connected; } }

20. 20/34 SYRCoSE 2009, May 28 Server

21. 21/34 SYRCoSE 2009, May 28

22. [G. Nelson & J. B. Saxe et al. 1991]  Search for bugs  Sound analysis 22/34 SYRCoSE 2009, May 28 Requirements & Rules Source Code Behavior model Analysis Tool Provers, Solvers, Model Checkers

23.  ESC/Modula 31995DEC G. Nelson, J. B. Saxe, K. R. M. Leino, D. Detlefs  ESC/Java2000 Compaq K. R. M. Leino, C. Flanagan  ASTREE2002 CNRS P. Cousot http://www.astree.ens.fr/  ESC/Java 22004 http://kind.ucd.ie/products/opensource/ESCJava2/  Simplify  Spec# Checker2004Microsoft Research K. R. M. Leino http://research.microsoft.com/SpecSharp/  Boogie  Calysto2008University of British Columbia 23/34 SYRCoSE 2009, May 28

24.  Boolean satisfiability (SAT) (x 1  ~x 2 ) & (~x 1  x 3 )  Linear integer arithmetics x 1 < x 2 + 3  Floating-point arithmetics x 1 · x 2 = 2.5  Polyhedra 0.2x 1 +3x 3 > x 2 –3.7x 4  Ellipsoids 2x 1 2 +1.3x 2 2 ≤ 76.9  Heap structures x 1 →p→p ≠ x 2 →p …… 24/34 SYRCoSE 2009, May 28

25. Counterexample guided abstraction refinement CEGAR [E. M. Clarke & O. Grumberg et al 2000, T. Ball & S. K. Rajamani 2000] 25/34 SYRCoSE 2009, May 28 do { nPacketsOld = nPackets;... if(request) {... nPackets++; } } while (nPackets != nPacketsOld); do { b = true;... if(request) {... b = b?false:*; } } while (!b);

26. 26/34 SYRCoSE 2009, May 28 26 / 1 4 Behavior Model Model Checking Counterexample Behavior Model Test Data and Scenario Approval Bug! Refutation Model Refinement Correctness Rules Code under check

27.  SLAM2001Microsoft Research T. Ball, S. K. Rajamani et al. http://research.microsoft.com/en-us/projects/slam/  Static Driver Verifier2007Microsoft http://www.microsoft.com/whdc/devtools/tools/sdv.mspx  BLAST2003UC Berkeley T. A. Henzinger, R. Jhala, R. Majumdar, G. Sutre http://mtc.epfl.ch/software-tools/blast/  MAGIC2003SCS Carnegie Mellon E. M. Clarke, S. Chaki et al. http://www.cs.cmu.edu/~chaki/magic/ 27/34 SYRCoSE 2009, May 28

28. [K. Havelund & W. Visser 1999]  Java Path Finder + symbolic execution + test generation http://javapathfinder.sourceforge.net/ System under check 28/34 SYRCoSE 2009, May 28 Behavior model Monitoring Environment State model and oracle

29. [??? 2003-2004]  Targeting to cover various paths in source/byte code  Test oracle  No exceptions NullPointer, IndexOutOfBounds, ClassCast, DivideByZero, IllegalArgument  Annotations and formal models  Test data and sequences generation  Random  Symbolic execution + constraint resolution  State abstraction  Heuristic search 29/34 SYRCoSE 2009, May 28

30. [Y. Smaragdakis, C. Csallner]  JCrasher2004  Check-n-Crash2005  DSD-Crasher2006 http://ranger.uta.edu/~csallner/dsd-crasher/ 30/34 SYRCoSE 2009, May 28 Daikon ESC/Java 2 solver

31. [P. Godefroid, G. Agha, K. Sen 2005]  CUTE2005 Consolic testing (concrete + symbolic)  jCUTE2006 31/34 SYRCoSE 2009, May 28 Execution Program Symbolic Execution Looking for new paths Tests

32.  SAGE2007  Pex2007 N. Tillmann, W. Schulte, J. de Halleux http://research.microsoft.com/Pex/default.aspx 32/34 SYRCoSE 2009, May 28 00000000h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 0 – initial input – 100 bytes of “00” 00000000h: 52 49 46 46 00 00 00 00 00 00 00 00 00 00 00 00 ; RIFF............ 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 1 00000000h: 52 49 46 46 00 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF....***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 2 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 3 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 00 00 00 00 ;....strh........ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 4 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 5 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 00 00 00 00 ;....strf........ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 6 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ;....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 7 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ;....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 C9 9D E4 4E ;............ÉäN 00000060h: 00 00 00 00 ;.... Generation 8 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ;....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 9 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...***.... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ;................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ;....strh....vids 00000040h: 00 00 00 00 73 74 72 66 B2 75 76 3A 28 00 00 00 ;....strf²uv:(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ;................ 00000060h: 00 00 00 00 ;.... Generation 10 – bug ID 1212954973! Found after only 3 generations starting from “well-formed” seed file

33.  EXE2005Stanford Univ. D. Dill, D. Engler et al.  Randoop2007MIT + MS Research T. Ball, M. D. Ernst, C. Pacheco, S. Lahiri http://people.csail.mit.edu/cpacheco/randoop/1.2/doc/ …… 33/34 SYRCoSE 2009, May 28

34.  Modern verification tools  Use basic services of component technologies  Integrate a lot of techniques  Become highly modular  Can be modules of each other  Next step – integration frameworks ?  Java PathFinder  Bogor http://bogor.projects.cis.ksu.edu/  Microsoft RiSE http://research.microsoft.com/en-us/um/redmond/groups/rise/ 34/34 SYRCoSE 2009, May 28