1. HW6: Due Dec 8th 23:59 1.Describe test cases to reach full path coverage of the triangle program by completing the path condition table below. Also, draw the complete execution tree showing executed path conditions. –Assume that the initial test case is given as 1,1,1 –You should use the DFS algorithm. –You are required to get a concrete solution by using Z3/Yices Describe a SMTLIB spec for each next path condition and attach the snapshots of Z3/Yic es results on the SMTLIB spec Test cas e Input (a,b,c) Executed path conditions (PC) Next PCSolution for the next PC 11,1,1a=b Æ a=c Æ b=c a=b Æ a=c Æ b  c Unsat a=b Æ a  c 1,1,2 2 a=b Æ a  c Æ b  c Æ a+b ≤ c a=b Æ a  c Æ b  c Æ a+b > c 2,2,3 3 a=b Æ a  c Æ b  c Æ a+b > c a=b Æ a  c Æ b=c Unsat abab 2,1,2 4 a  b Æ a=c Æ b  c Æ a+c > b a  bÆ a=c Æ b  c Æ a+c ≤ b 2,5,2

2. 2. Test flash_read() by using CREST 1.Describe your environment model You may use the similar environment model for HW#3-1 but need to m odify You have to specify an assert statement for checking correctness. 2.Enumerate all generated test cases through concolic testing and their result (i.e. assert pass/fail) –/* (pu_id, sect#) for the figure below */ Testcase 1: a (0,1), b (1,1), c (1,2) d (2,3) 3. Compare this concolic experiment with the CBMC experiments in HW#3-1 1. Covered cases/distributions 2. Performance 10 1 2 3 ab c d Sector 0 Sector 1 Sector 2 Sector 3 PU0~PU3 A distribution of “abcd” SAM0~SAM3

3. typedef struct _SAM_type{ unsigned char offset[SECT_PER_U]; }SAM_type; typedef struct _PU_type{ unsigned char sect[SECT_PER_U]; }PU_type; // Environment assumption // 0. Each unit contains 4 sectors. // 1. There is one logical unit containing "abcd" // 2. There are 4 physical units // 3. The value of SAM table is 255 if the corresponding // physical sector does not have a valid data void flash_read(char *buf, SAM_type *SAM, PU_type *pu ){ unsigned char nSamIdx = 0; unsigned char pu_id = 0; unsigned char n_scts = 4; // number of sectors to read unsigned char offset = 0; //offset of the physical sector to read unsigned char pBuf = 0; while(n_scts > 0){ pu_id=0; offset = 255; // read 1 character while(1) { if (SAM[pu_id].offset[nSamIdx] != 255){ offset = SAM[pu_id].offset[nSamIdx++]; buf[pBuf] = PU[pu_id].sect[offset]; break; } pu_id ++; } n_scts--; pBuf ++; }

4. 3. Prove the correctness of copy2 by using WHY - You should write down requires/ensures annotation - You may also need loop invariant, variant, and assertion /* Contract: Return value should be same as input value x as long as x >= 0 */ int copy2(int x) { int y=0; while(y !=x) { y++; } return y; }