1. Automated Verification with HIP and SLEEK Asankhaya Sharma

2. Recall the List length Example int length(struct node* p) /*@ requires p::list ensures p::list & res=n; */ { if(p == NULL) return 0; else return 1 + length(p->next); } Memory Safety Length of the List Bag of Values

3. With Inference int length(struct node* p) /*@ infer [H,G] requires H(p) ensures G(p); */ { if(p == NULL) return 0; else return 1 + length(p->next); } Second Order Variables for Unknown Predicates Modular Shape Inference

4. Relational Assumptions // Post (1) H(p) & x = null => G(p) // Bind (2) H(p) & x != null => x::node * HP(q) // Pre-Rec (3) HP(q) => H(p) //Post (4) x::node * G(q) => G(p)

5. Predicate Derivation For Pre Condition H(p) == emp & p = null or p::node * H(q) For Post Condition G(p) == emp * p = null or p::node * G(q) Linked List Predicate Inferred Automatically

6. Bi-Abduction antecedent consequentresidue Compositional shape analysis by means of bi-abduction Calcagno C, Distefano D, O'Hearn P W and Yang H POPL 2009 Achievement : Scalable automated shape analysis! precondition

7. Incremental Specification Formal specs are important for verification and documentation. Tedious for legacy system and maintenance efforts. Users role to guide inference process Our thesis : Specification can be developed incrementally and when needed.

8. Inference Example infer [x,Q3] requires x::ll  n 1   y::ll  n 2  ensures x::ll  n 3  & Q3(n 1,n 2,n 3 ) requires x::ll  n 1   y::ll  n 2  & x  null ensures x::ll  n 3  & n 1 +n 2 =n 3

9. Inference Example infer [R] requires x::ll  n 1   y::ll  n 2  & n  null & Term[R(n 1, n 2 )] ensures x::ll  n 3  & n 1 +n 2 =n 3 requires x::ll  n 1   y::ll  n 2  & n  null & Term[n 1 ] ensures x::ll  n 3  & n 1 +n 2 =n 3

10. Selective Entailment antecedent consequent residue precondition definitions

11. Key Principles Selective Inference Inferable Heap Locations Never Inferring False Antecedent Contradiction Unknown Relation/Function Derivation

12. Selective Inference x  null q:: ll  n-1  n > 0

13. Selective Inference FAIL emp n=1

14. Inferring Heap Locations Heap state may be inferred x ::node Allows predicates to be inferred Allows cascaded heaps by adding auxiliary variables emp

15. Never Inferring False FAIL

16. Antecedent Contradiction What if contradiction detected between  1 and  2 ? Add pre over v* to support contradicted antecedent.

17. Antecedent Contradiction false x  null false

18. Selective Inference

19. FixPoint Calculation

20. Inferring Heap Locations Auxiliary variables may be added x ::node  x 1 ::node & x 1 =q x ::node & x 1 =q

21. Inferring Unknown Relations Two kinds of relationships inferred Relational Obligation: Relational Definition:

22. Further Reading Trinh, Minh-Thai, Quang Loc Le, Cristina David, and Wei-Ngan Chin. "Bi-Abduction with Pure Properties for Specification Inference." In Programming Languages and Systems, pp. 107-123. Springer International Publishing, 2013.