Hybrid Verification in SPARK 2014: Combining Formal Methods with Testing

Size: px
Start display at page:

Download "Hybrid Verification in SPARK 2014: Combining Formal Methods with Testing"

Transcription

1 IEEE Software Technology Conference 2015 Hybrid Verification in SPARK 2014: Combining Formal Methods with Testing Steve Baird Senior Software Engineer Copyright 2014 AdaCore Slide: 1

2 procedure Array_Indexing_Bug (Buffer : in out String) is -- intended to change "ABCD" into "AABC", -- but high loop bound is bad begin for I in Buffer'First.. Buffer'Last loop Buffer (I + 1) := Buffer (I); end loop; end Array_Indexing_Bug;

3 "Program testing can be used to show the presence of bugs, but never to show their absence!" -- Edsger Dijkstra, 1970

4 Contract: agreement between the client and the supplier of a service Program contract: agreement between the caller and the callee subprograms

5 Each assertion serves three functions: a static proof goal during proving a dynamic consistency check during testing documentation for the human reader Because the same assertion serves all three functions, consistency is guaranteed. See Chalin's "Engineering a Sound Assertion Semantics for the Verifying Compiler".

6 Buffer overflows in Ada? Easily avoided by programmers (array types carry their bounds) Automatically caught at run-time Integer overflows in Ada? Easily avoided by programmers (using bounded integer types) Automatically caught at run-time Buffer and integer overflows in SPARK? If present, automatically caught by analysis If absent, automatic proof that no such error can occur Buffer overflows and integer overflows are still major sources of pain in C

7 Two advantages of formal verification: bugs which testing would have caught may be caught earlier bugs which testing would have missed may be caught

8 Assertions also serve as documentation for human readers

9 Quantified expressions: (for all I in Vec'Range => Vec (I) <= Max_Element) (for some I in Vec'Range => Vec (I) = Max_Element) Conditional expressions: (if Y /= 0 then X / Y else Integer'Last) (case Adjustment is when Double => 2 * X, when Increment => X + 1, when None => X) The Old attribute: procedure Increment (X : in out Integer) with Pre => X /= Integer'Last, Post => X = X'Old + 1; Expression functions: function Is_Even (X : Natural) return Boolean is (X mod 2 = 0);

10 Ghost code: useful for assertions in verification useful for consistency checks in testing can be safely and easily disabled in the final build

11 SPARK 2014 supports a large Ada subset concurrency (tasks and protected objects) object oriented programming (tagged types) recursion dynamic constraints

12 Combining tests and proofs P is tested P Q P calls Q How do we justify assumptions made during proof? Q calls P Q is proved verification combining tests and proofs should be AT LEAST AS GOOD AS verification based on tests only Copyright 2014 AdaCore Slide: 12

13 Caution: contracts are not only pre/post! strong typing parameters not aliased ) data dependences parameters initialized Copyright 2014 AdaCore Slide: 13

14 Implicit precondition violation examples: type Rec is record F1, F2 : Integer; end record; procedure P1 (X : Rec) is... ; procedure Q1 is Y : Rec; begin Y.F1 := 123; P1 (Y); -- parameter incompletely initialized end Q1; Buffer : String ( ); procedure P2 (X : in out String) with Global => (In_Out => Buffer) is ; procedure Q2 is begin P2 (X => Buffer); -- unsafe aliasing end Q2; Copyright 2014 AdaCore Slide: 14

15 Cost of testing Cost of testing greater than cost of development 10% increase each year for avionics software (Boeing META Project) Uneven partitioning: 80% of effort! Uneven quality: 80% of errors traced to 20% of code (NASA Software Safety Guidebook) Need to reduce and focus the cost of testing Copyright 2014 AdaCore Slide: 15

16 Proving and testing can be combined at different levels At the level of individual run-time checks: Focus test coverage on unproven checks At the level of individual subprograms: Proven subprograms call tested and vice versa. Use proofs to completely replace unit testing and executable contracts during integration testing Copyright 2014 AdaCore Slide: 16

17 Resources SPARK Pro webpage SPARK community page SPARK User s Guide AdaCore University Copyright 2014 AdaCore Slide: 17

18

Ada 2012, SPARK 2014, and Combining Proof and Test!

Ada 2012, SPARK 2014, and Combining Proof and Test! Presentation cover page EU Ada 2012, SPARK 2014, and Combining Proof and Test! Tucker Taft AdaCore Inc Languages and Tools for High Integrity Bergen, Norway February, 2014 www.adacore.com Cost of testing

More information

A Comparison of SPARK with MISRA C and Frama-C

A Comparison of SPARK with MISRA C and Frama-C A Comparison of SPARK with MISRA C and Frama-C Johannes Kanig, AdaCore October 2018 Abstract Both SPARK and MISRA C are programming languages intended for high-assurance applications, i.e., systems where

More information

WHITE PAPER. 10 Reasons to Use Static Analysis for Embedded Software Development

WHITE PAPER. 10 Reasons to Use Static Analysis for Embedded Software Development WHITE PAPER 10 Reasons to Use Static Analysis for Embedded Software Development Overview Software is in everything. And in many embedded systems like flight control, medical devices, and powertrains, quality

More information

GNAT Pro Innovations for High-Integrity Development

GNAT Pro Innovations for High-Integrity Development GNAT Pro Innovations for High-Integrity Development José F. Ruiz Senior Software Engineer Ada Europe 2010, Valencia 2010-06-15 www.adacore.com Index Development environment Tools Static

More information

Spark verification features

Spark verification features Spark verification features Paul Jackson School of Informatics University of Edinburgh Formal Verification Spring 2018 Adding specification information to programs Verification concerns checking whether

More information

CIS 890: Safety Critical Systems

CIS 890: Safety Critical Systems CIS 890: Safety Critical Systems Lecture: SPARK -- Analysis Tools Copyright 2007, John Hatcliff. The syllabus and all lectures for this course are copyrighted materials and may not be used in other course

More information

Contract-based Programming: a Route to Finding Bugs Earlier

Contract-based Programming: a Route to Finding Bugs Earlier Contract-based Programming: a Route to Finding Bugs Earlier JSA Research & Innovation February 2018 Subprogram Contracts Type Contracts Contract-based Programming A software development technique, used

More information

Leveraging Formal Methods Based Software Verification to Prove Code Quality & Achieve MISRA compliance

Leveraging Formal Methods Based Software Verification to Prove Code Quality & Achieve MISRA compliance Leveraging Formal Methods Based Software Verification to Prove Code Quality & Achieve MISRA compliance Prashant Mathapati Senior Application Engineer MATLAB EXPO 2013 The MathWorks, Inc. 1 The problem

More information

18-642: Code Style for Compilers

18-642: Code Style for Compilers 18-642: Code Style for Compilers 9/6/2018 2017-2018 Philip Koopman Programming can be fun, so can cryptography; however they should not be combined. Kreitzberg and Shneiderman 2017-2018 Philip Koopman

More information

AdaCore technologies

AdaCore technologies AdaCore technologies for CENELEC EN 50128 2011 Eric Perlade Technical Account Manager RSSRail 2017 CENELEC EN 50128:2011 CENELEC EN 50128 Main standards applicable to railway systems Complete System 50126

More information

A3. Programming Languages for Writing Safety-Critical Software

A3. Programming Languages for Writing Safety-Critical Software A3. Programming Languages for Writing Safety-Critical Software (a) Overview. (b) SPARK Ada. Critical Systems, CS 411, Lent term 2002, Sec. A3 A3-1 (a) Overview Important Factors for Programming Languages

More information

Verification and Test with Model-Based Design

Verification and Test with Model-Based Design Verification and Test with Model-Based Design Flight Software Workshop 2015 Jay Abraham 2015 The MathWorks, Inc. 1 The software development process Develop, iterate and specify requirements Create high

More information

SPARK Update Ada Europe 2012

SPARK Update Ada Europe 2012 [SPARK] SPARK Update Ada Europe 2012 Stuart Matthews Copyright Altran Praxis Contents Background SPARK Pro Product Update SPARK Book New Edition SPARK Training Copyright Altran Praxis Corporate Markets

More information

CS 161 Computer Security

CS 161 Computer Security Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions

More information

Intro to Proving Absence of Errors in C/C++ Code

Intro to Proving Absence of Errors in C/C++ Code Intro to Proving Absence of Errors in C/C++ Code Develop high quality embedded software Kristian Lindqvist Senior Pilot Engineer MathWorks 2016 The MathWorks, Inc. 1 The Cost of Failure Ariane 5: Overflow

More information

Simulink 모델과 C/C++ 코드에대한매스웍스의정형검증툴소개 The MathWorks, Inc. 1

Simulink 모델과 C/C++ 코드에대한매스웍스의정형검증툴소개 The MathWorks, Inc. 1 Simulink 모델과 C/C++ 코드에대한매스웍스의정형검증툴소개 2012 The MathWorks, Inc. 1 Agenda Formal Verification Key concept Applications Verification of designs against (functional) requirements Design error detection Test

More information

Building Better and Safer Programs Using SPARK and Ada. William Wong 23 March 2019

Building Better and Safer Programs Using SPARK and Ada. William Wong 23 March 2019 Building Better and Safer Programs Using SPARK and Ada William Wong 23 March 2019 Intent of This Presentation - Highlight Ada and SPARK programming features Provide a general overview of major features

More information

Program Verification (6EC version only)

Program Verification (6EC version only) Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language

More information

Warm-Up Problem. Let be a set of well-formed Predicate logic formulas. Let be well-formed Predicate logic formulas. Prove or disprove the following.

Warm-Up Problem. Let be a set of well-formed Predicate logic formulas. Let be well-formed Predicate logic formulas. Prove or disprove the following. Warm-Up Problem Let be a set of well-formed Predicate logic formulas Let be well-formed Predicate logic formulas Prove or disprove the following If then 1/35 Program Verification Carmen Bruni Lecture 18

More information

Implementation Guidance for the Adoption of SPARK

Implementation Guidance for the Adoption of SPARK Implementation Guidance for the Adoption of SPARK Release 1.0 AdaCore and Thales Jan 26, 2017 Copyright (C) 2016-2017, AdaCore and Thales Licensed under Creative Commons Attribution 4.0 International CONTENTS

More information

Practical Development of Safe, Secure, Reliable Embedded Software

Practical Development of Safe, Secure, Reliable Embedded Software ARM TechCon 2017 Practical Development of Safe, Secure, Reliable Embedded Software Pat Rogers rogers@adacore.com Why Safe, Secure, or Reliable? Your car could crash Your flight could crash Your medical

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember: just do the counterexample guided abstraction refinement part of DPLL(T). If you notice any other errors, those are good

More information

SPARKSkein A Formal and Fast Reference Implementation of Skein

SPARKSkein A Formal and Fast Reference Implementation of Skein SPARKSkein A Formal and Fast Reference Implementation of Skein Rod Chapman, Altran Praxis Copyright Altran Praxis Agenda The big idea What is Skein? Coding SPARKSkein Results The release Conclusions and

More information

Verification and Validation of Models for Embedded Software Development Prashant Hegde MathWorks India Pvt. Ltd.

Verification and Validation of Models for Embedded Software Development Prashant Hegde MathWorks India Pvt. Ltd. Verification and Validation of Models for Embedded Software Development Prashant Hegde MathWorks India Pvt. Ltd. 2015 The MathWorks, Inc. 1 Designing complex systems Is there something I don t know about

More information

Combining program verification with component-based architectures. Alexander Senier BOB 2018 Berlin, February 23rd, 2018

Combining program verification with component-based architectures. Alexander Senier BOB 2018 Berlin, February 23rd, 2018 Combining program verification with component-based architectures Alexander Senier BOB 2018 Berlin, February 23rd, 2018 About Componolit 2 What happens when we use what's best? 3 What s Best? Mid-90ies:

More information

Behavioral Equivalence

Behavioral Equivalence Behavioral Equivalence Prof. Clarkson Fall 2015 Today s music: Soul Bossa Nova by Quincy Jones Review Previously in 3110: Functional programming Modular programming Interpreters Imperative and concurrent

More information

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 1 1/ 38

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 1 1/ 38 CSC313 High Integrity Systems/CSCM13 Critical Systems CSC313/CSCM13 Chapter 1 1/ 38 CSC313 High Integrity Systems/ CSCM13 Critical Systems Course Notes Chapter 1: Programming Languages for Writing Safety-Critical

More information

Software Security: Vulnerability Analysis

Software Security: Vulnerability Analysis Computer Security Course. Software Security: Vulnerability Analysis Program Verification Program Verification How to prove a program free of buffer overflows? Precondition Postcondition Loop invariants

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember that you can t just define a meaning function in terms of itself you must use some fixed point machinery. #2 #3 Observations

More information

Hoare Logic. COMP2600 Formal Methods for Software Engineering. Rajeev Goré

Hoare Logic. COMP2600 Formal Methods for Software Engineering. Rajeev Goré Hoare Logic COMP2600 Formal Methods for Software Engineering Rajeev Goré Australian National University Semester 2, 2016 (Slides courtesy of Ranald Clouston) COMP 2600 Hoare Logic 1 Australian Capital

More information

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 2 1/ 221

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 2 1/ 221 CSC313 High Integrity Systems/CSCM13 Critical Systems CSC313/CSCM13 Chapter 2 1/ 221 CSC313 High Integrity Systems/ CSCM13 Critical Systems Course Notes Chapter 2: SPARK Ada Sect. 2 (f) Anton Setzer Dept.

More information

Statement Basics. Assignment Statements

Statement Basics. Assignment Statements Statement Basics The meaning of a single statement executed in a state s is a new state s, which reflects the effects of the statement M stmt ( stmt, s) = s N. Meng, S. Arthur 1 Assignment Statements M

More information

Static Analysis in C/C++ code with Polyspace

Static Analysis in C/C++ code with Polyspace 1 Static Analysis in C/C++ code with Polyspace Yongchool Ryu Application Engineer gary.ryu@mathworks.com 2016 The MathWorks, Inc. 2 Agenda Efficient way to find problems in Software Category of Static

More information

Static Analysis Techniques

Static Analysis Techniques oftware Design (F28SD2): Static Analysis Techniques 1 Software Design (F28SD2) Static Analysis Techniques Andrew Ireland School of Mathematical and Computer Science Heriot-Watt University Edinburgh oftware

More information

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,

More information

Advanced Programming Methods. Introduction in program analysis

Advanced Programming Methods. Introduction in program analysis Advanced Programming Methods Introduction in program analysis What is Program Analysis? Very broad topic, but generally speaking, automated analysis of program behavior Program analysis is about developing

More information

SPARK 2014 User s Guide

SPARK 2014 User s Guide SPARK 2014 User s Guide Release 19.0w AdaCore and Altran UK Ltd Apr 27, 2018 Copyright (C) 2011-2017, AdaCore and Altran UK Ltd Permission is granted to copy, distribute and/or modify this document under

More information

Behavioral Equivalence

Behavioral Equivalence Behavioral Equivalence Prof. Clarkson Fall 2016 Today s music: Soul Bossa Nova by Quincy Jones Review Previously in 3110: Functional programming Modular programming & software engineering Interpreters

More information

Principles of Software Construction: Objects, Design, and Concurrency (Part 2: Designing (Sub )Systems)

Principles of Software Construction: Objects, Design, and Concurrency (Part 2: Designing (Sub )Systems) Principles of Software Construction: Objects, Design, and Concurrency (Part 2: Designing (Sub )Systems) More Analysis for Functional Correctness Jonathan Aldrich Charlie Garrod School of Computer Science

More information

Chapter 1. Introduction

Chapter 1. Introduction 1 Chapter 1 Introduction An exciting development of the 21st century is that the 20th-century vision of mechanized program verification is finally becoming practical, thanks to 30 years of advances in

More information

Pierce Ch. 3, 8, 11, 15. Type Systems

Pierce Ch. 3, 8, 11, 15. Type Systems Pierce Ch. 3, 8, 11, 15 Type Systems Goals Define the simple language of expressions A small subset of Lisp, with minor modifications Define the type system of this language Mathematical definition using

More information

Lectures 20, 21: Axiomatic Semantics

Lectures 20, 21: Axiomatic Semantics Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Static Analysis Based on slides by George Necula Pratikakis (CSD) Axiomatic Semantics

More information

Lecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning

Lecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning Lecture 1 Contracts 15-122: Principles of Imperative Computation (Spring 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,

More information

Implementing Subprograms

Implementing Subprograms 1 Implementing Subprograms CS 315 Programming Languages Pinar Duygulu Bilkent University CS315 Programming Languages Pinar Duygulu The General Semantics of Calls and Returns 2 The subprogram call and return

More information

A Correctness Proof for a Practical Byzantine-Fault-Tolerant Replication Algorithm

A Correctness Proof for a Practical Byzantine-Fault-Tolerant Replication Algorithm Appears as Technical Memo MIT/LCS/TM-590, MIT Laboratory for Computer Science, June 1999 A Correctness Proof for a Practical Byzantine-Fault-Tolerant Replication Algorithm Miguel Castro and Barbara Liskov

More information

Leveraging Formal Methods for Verifying Models and Embedded Code Prashant Mathapati Application Engineering Group

Leveraging Formal Methods for Verifying Models and Embedded Code Prashant Mathapati Application Engineering Group Leveraging Formal Methods for Verifying Models and Embedded Code Prashant Mathapati Application Engineering Group 2014 The MathWorks, Inc. 1 The Cost of Failure News reports: Recall Due to ECU software

More information

CSCI-GA Scripting Languages

CSCI-GA Scripting Languages CSCI-GA.3033.003 Scripting Languages 12/02/2013 OCaml 1 Acknowledgement The material on these slides is based on notes provided by Dexter Kozen. 2 About OCaml A functional programming language All computation

More information

A Gentle Introduction to Program Analysis

A Gentle Introduction to Program Analysis A Gentle Introduction to Program Analysis Işıl Dillig University of Texas, Austin January 21, 2014 Programming Languages Mentoring Workshop 1 / 24 What is Program Analysis? Very broad topic, but generally

More information

(See related materials in textbook.) CSE 435: Software Engineering (slides adapted from Ghezzi et al & Stirewalt

(See related materials in textbook.) CSE 435: Software Engineering (slides adapted from Ghezzi et al & Stirewalt Verification (See related materials in textbook.) Outline What are the goals of verification? What are the main approaches to verification? What kind of assurance do we get through testing? How can testing

More information

Lecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning

Lecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning Lecture 1 Contracts 15-122: Principles of Imperative Computation (Fall 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,

More information

Violations of the contract are exceptions, and are usually handled by special language constructs. Design by contract

Violations of the contract are exceptions, and are usually handled by special language constructs. Design by contract Specification and validation [L&G Ch. 9] Design patterns are a useful way to describe program structure. They provide a guide as to how a program fits together. Another dimension is the responsibilities

More information

Programming Languages: Lecture 12

Programming Languages: Lecture 12 1 Programming Languages: Lecture 12 Chapter 10: Implementing Subprograms Jinwoo Kim jwkim@jjay.cuny.edu Chapter 10 Topics 2 The General Semantics of Calls and Returns Implementing Simple Subprograms Implementing

More information

Enhance Verification using Ghost Code

Enhance Verification using Ghost Code Enhance Verification using Ghost Code Claire Dross SSAS Workshop 2018 Ghost Code, What Is It? 2 Ghost Code General Definition Ghost code does not affect normal execution of a program. Regular Code Ghost

More information

Lecture 3 Notes Arrays

Lecture 3 Notes Arrays Lecture 3 Notes Arrays 15-122: Principles of Imperative Computation (Summer 1 2015) Frank Pfenning, André Platzer 1 Introduction So far we have seen how to process primitive data like integers in imperative

More information

Verification by Static Analysis

Verification by Static Analysis Verification by Static Analysis Intelligent Testing Conference Bristol, 17 th March 2014 Verification overview Software Verification is The process of evaluating software during or at the end of the development

More information

Testing. Prof. Clarkson Fall Today s music: Wrecking Ball by Miley Cyrus

Testing. Prof. Clarkson Fall Today s music: Wrecking Ball by Miley Cyrus Testing Prof. Clarkson Fall 2017 Today s music: Wrecking Ball by Miley Cyrus Review Previously in 3110: Modules Specification (functions, modules) Today: Validation Testing Black box Glass box Randomized

More information

C07: Testing and JUnit

C07: Testing and JUnit CISC 3120 C07: Testing and JUnit Hui Chen Department of Computer & Information Science CUNY Brooklyn College 9/19/2017 CUNY Brooklyn College 1 Outline Recap and issues Grades and feedback Assignments &

More information

ABSTRACT INTERPRETATION

ABSTRACT INTERPRETATION Master of Science in Engineering ABSTRACT INTERPRETATION Pascal Roman Artho, partho@hsr.ch Seminar Program Analysis and Transformation Rapperswil, January 7, 2015 Agenda Informal Example What is the idea

More information

Contents. Program 1. Java s Integral Types in PVS (p.4 of 37)

Contents. Program 1. Java s Integral Types in PVS (p.4 of 37) Java s Integral Types in PVS Bart Jacobs bart@cs.kun.nl www.cs.kun.nl/ bart www.verificard.org. Dep. Computer Science, Univ. Nijmegen, NL Contents I. Example programs II. Integral types in Java (implementations)

More information

From Design to Production

From Design to Production From Design to Production An integrated approach Paolo Fabbri Senior Engineer 2014 The MathWorks, Inc. 1 Do you know what it is? Requirements System Test Functional Spec Integration Test Detailed Design

More information

Safe Dynamic Memory Management in Ada and SPARK

Safe Dynamic Memory Management in Ada and SPARK Safe Dynamic Memory Management in Ada and SPARK Maroua Maalej, Tucker Taft, Yannick Moy AdaCore Ada-Europe June 19, 2018 Safe Dynamic Memory Management in Ada and SPARK Maroua Maalej 1/28 Why Try To Verify

More information

CITS5501 Software Testing and Quality Assurance Formal methods

CITS5501 Software Testing and Quality Assurance Formal methods CITS5501 Software Testing and Quality Assurance Formal methods Unit coordinator: Arran Stewart May 1, 2018 1 / 49 Sources Pressman, R., Software Engineering: A Practitioner s Approach, McGraw-Hill, 2005

More information

Lecture Notes on Arrays

Lecture Notes on Arrays Lecture Notes on Arrays 15-122: Principles of Imperative Computation July 2, 2013 1 Introduction So far we have seen how to process primitive data like integers in imperative programs. That is useful,

More information

Formal Verification in Aeronautics: Current Practice and Upcoming Standard. Yannick Moy, AdaCore ACSL Workshop, Fraunhofer FIRST

Formal Verification in Aeronautics: Current Practice and Upcoming Standard. Yannick Moy, AdaCore ACSL Workshop, Fraunhofer FIRST Formal Verification in Aeronautics: Current Practice and Upcoming Standard Yannick Moy, AdaCore ACSL Workshop, Fraunhofer FIRST Outline Project Hi-Lite Industrial Applications DO-178C DO-178B 1992 2012

More information

Program Verification. Program Verification 307/434

Program Verification. Program Verification 307/434 Program Verification Program Verification 307/434 Outline Introduction: What and Why? Pre- and Postconditions Conditionals while-loops and Total Correctness Arrays Program Verification Introduction 308/434

More information

Runtime Checking for Program Verification Systems

Runtime Checking for Program Verification Systems Runtime Checking for Program Verification Systems Karen Zee, Viktor Kuncak, and Martin Rinard MIT CSAIL Tuesday, March 13, 2007 Workshop on Runtime Verification 1 Background Jahob program verification

More information

2015 The MathWorks, Inc. 1

2015 The MathWorks, Inc. 1 2015 The MathWorks, Inc. 1 신호처리응용을위한 Model Based Design Workflow 이웅재부장 2015 The MathWorks, Inc. 2 CASE: Software in Signal Processing Application (Medical) Medical devices are increasingly driven by complex

More information

Green Hills Software, Inc.

Green Hills Software, Inc. Green Hills Software, Inc. A Safe Tasking Approach to Ada95 Jim Gleason Engineering Manager Ada Products 5.0-1 Overview Multiple approaches to safe tasking with Ada95 No Tasking - SPARK Ada95 Restricted

More information

Model-Based Design for High Integrity Software Development Mike Anthony Senior Application Engineer The MathWorks, Inc.

Model-Based Design for High Integrity Software Development Mike Anthony Senior Application Engineer The MathWorks, Inc. Model-Based Design for High Integrity Software Development Mike Anthony Senior Application Engineer The MathWorks, Inc. Tucson, AZ USA 2009 The MathWorks, Inc. Model-Based Design for High Integrity Software

More information

Chapter 10. Implementing Subprograms ISBN

Chapter 10. Implementing Subprograms ISBN Chapter 10 Implementing Subprograms ISBN 0-321-33025-0 Chapter 10 Topics The General Semantics of Calls and Returns Implementing Simple Subprograms Implementing Subprograms with Stack-Dynamic Local Variables

More information

By V-cubed Solutions, Inc. Page1. All rights reserved by V-cubed Solutions, Inc.

By V-cubed Solutions, Inc.   Page1. All rights reserved by V-cubed Solutions, Inc. By V-cubed Solutions, Inc. Page1 Purpose of Document This document will demonstrate the efficacy of CODESCROLL CODE INSPECTOR, CONTROLLER TESTER, and QUALITYSCROLL COVER, which has been developed by V-cubed

More information

Seminar in Software Engineering Presented by Dima Pavlov, November 2010

Seminar in Software Engineering Presented by Dima Pavlov, November 2010 Seminar in Software Engineering-236800 Presented by Dima Pavlov, November 2010 1. Introduction 2. Overview CBMC and SAT 3. CBMC Loop Unwinding 4. Running CBMC 5. Lets Compare 6. How does it work? 7. Conclusions

More information

Synchronization SPL/2010 SPL/20 1

Synchronization SPL/2010 SPL/20 1 Synchronization 1 Overview synchronization mechanisms in modern RTEs concurrency issues places where synchronization is needed structural ways (design patterns) for exclusive access 2 Overview synchronization

More information

G Programming Languages - Fall 2012

G Programming Languages - Fall 2012 G22.2110-003 Programming Languages - Fall 2012 Lecture 4 Thomas Wies New York University Review Last week Control Structures Selection Loops Adding Invariants Outline Subprograms Calling Sequences Parameter

More information

A Verified Implementation of the Bounded List Container

A Verified Implementation of the Bounded List Container A Verified Implementation of the Bounded List Container Raphaël Cauderlier, Mihaela Sighireanu March 26, 2018 1 / 32 Outline 1 Introduction 2 Bounded Doubly-Linked Lists 3 Verification 4 Conclusion 2 /

More information

GeneAuto for Ada and SPARK

GeneAuto for Ada and SPARK GeneAuto for Ada and SPARK A verifying model compiler Matteo Bordin bordin@adacore.com Franco Gasperoni gasperoni@adacore.com GeneAuto2 meeting (Toulouse) September 2009 Slide: 1 Model Compilers: State-of-the-Art

More information

Testing, Debugging, and Verification

Testing, Debugging, and Verification Testing, Debugging, and Verification Formal Specification, Part II Srinivas Pinisetty 23 November 2017 Introduction Today: Introduction to Dafny: An imperative language with integrated support for formal

More information

Modular and Verified Automatic Program Repairs

Modular and Verified Automatic Program Repairs Modular and Verified Automatic Program Repairs from Francesco Logozzo and Thomas Ball at Microsoft Research, Redmond presenter name(s) removed for FERPA considerations Introduction Your programs will have

More information

Static program checking and verification

Static program checking and verification Chair of Software Engineering Software Engineering Prof. Dr. Bertrand Meyer March 2007 June 2007 Slides: Based on KSE06 With kind permission of Peter Müller Static program checking and verification Correctness

More information

The Formal Semantics of Programming Languages An Introduction. Glynn Winskel. The MIT Press Cambridge, Massachusetts London, England

The Formal Semantics of Programming Languages An Introduction. Glynn Winskel. The MIT Press Cambridge, Massachusetts London, England The Formal Semantics of Programming Languages An Introduction Glynn Winskel The MIT Press Cambridge, Massachusetts London, England Series foreword Preface xiii xv 1 Basic set theory 1 1.1 Logical notation

More information

Deductive Verification in Frama-C and SPARK2014: Past, Present and Future

Deductive Verification in Frama-C and SPARK2014: Past, Present and Future Deductive Verification in Frama-C and SPARK2014: Past, Present and Future Claude Marché (Inria & Université Paris-Saclay) OSIS, Frama-C & SPARK day, May 30th, 2017 1 / 31 Outline Why this joint Frama-C

More information

Lecture 10 Design by Contract

Lecture 10 Design by Contract CS 5959 Writing Solid Code Fall 2015 Nov-23 Lecture 10 Design by Contract Zvonimir Rakamarić University of Utah Design by Contract Also called assume-guarantee reasoning Developers annotate software components

More information

Petri Nets ~------~ R-ES-O---N-A-N-C-E-I--se-p-te-m--be-r Applications.

Petri Nets ~------~ R-ES-O---N-A-N-C-E-I--se-p-te-m--be-r Applications. Petri Nets 2. Applications Y Narahari Y Narahari is currently an Associate Professor of Computer Science and Automation at the Indian Institute of Science, Bangalore. His research interests are broadly

More information

Bounded Model Checking Of C Programs: CBMC Tool Overview

Bounded Model Checking Of C Programs: CBMC Tool Overview Workshop on Formal Verification and Analysis Tools, CFDVS, IIT-Bombay - Feb 21,2017 Bounded Model Checking Of C Programs: CBMC Tool Overview Prateek Saxena CBMC Developed and Maintained by Dr Daniel Kröning

More information

Outline. Introduction Concepts and terminology The case for static typing. Implementing a static type system Basic typing relations Adding context

Outline. Introduction Concepts and terminology The case for static typing. Implementing a static type system Basic typing relations Adding context Types 1 / 15 Outline Introduction Concepts and terminology The case for static typing Implementing a static type system Basic typing relations Adding context 2 / 15 Types and type errors Type: a set of

More information

Static Analysis by A. I. of Embedded Critical Software

Static Analysis by A. I. of Embedded Critical Software Static Analysis by Abstract Interpretation of Embedded Critical Software Julien Bertrane ENS, Julien.bertrane@ens.fr Patrick Cousot ENS & CIMS, Patrick.Cousot@ens.fr Radhia Cousot CNRS & ENS, Radhia.Cousot@ens.fr

More information

Objectives for this class meeting. 1. Conduct review of core concepts concerning contracts and pre/post conditions

Objectives for this class meeting. 1. Conduct review of core concepts concerning contracts and pre/post conditions CSE1720 Click to edit Master Week text 01, styles Lecture 02 Second level Third level Fourth level Fifth level Winter 2015! Thursday, Jan 8, 2015 1 Objectives for this class meeting 1. Conduct review of

More information

Introduction to Axiomatic Semantics

Introduction to Axiomatic Semantics Introduction to Axiomatic Semantics Meeting 10, CSCI 5535, Spring 2009 Announcements Homework 3 due tonight Homework 2 is graded 13 (mean), 14 (median), out of 21 total, but Graduate class: final project

More information

Specification and verification of a simple machine

Specification and verification of a simple machine March 8, 2006 One slide summary Simple Virtual Machine Modeled a simple virtual machine: an interpreter + a static checker Proved that verified programs never overflow the operand stack Identified a suitable

More information

Verification Overview Testing Theory and Principles Testing in Practice. Verification. Miaoqing Huang University of Arkansas 1 / 80

Verification Overview Testing Theory and Principles Testing in Practice. Verification. Miaoqing Huang University of Arkansas 1 / 80 1 / 80 Verification Miaoqing Huang University of Arkansas Outline 1 Verification Overview 2 Testing Theory and Principles Theoretical Foundations of Testing Empirical Testing Principles 3 Testing in Practice

More information

Type Checking. Outline. General properties of type systems. Types in programming languages. Notation for type rules.

Type Checking. Outline. General properties of type systems. Types in programming languages. Notation for type rules. Outline Type Checking General properties of type systems Types in programming languages Notation for type rules Logical rules of inference Common type rules 2 Static Checking Refers to the compile-time

More information

Computer Security Course. Midterm Review

Computer Security Course. Midterm Review Computer Security Course. Dawn Song Midterm Review In class: Logistics On time: 4:10-5:30pm Wed 1 8x11 page cheat sheet allowed Special requirements: see TA Part I, II, III Scope Software Security Secure

More information

Warm-Up Problem. 1. What is the definition of a Hoare triple satisfying partial correctness? 2. Recall the rule for assignment: x (assignment)

Warm-Up Problem. 1. What is the definition of a Hoare triple satisfying partial correctness? 2. Recall the rule for assignment: x (assignment) Warm-Up Problem 1 What is the definition of a Hoare triple satisfying partial correctness? 2 Recall the rule for assignment: x (assignment) Why is this the correct rule and not the following rule? x (assignment)

More information

Lecture 10: Introduction to Correctness

Lecture 10: Introduction to Correctness Lecture 10: Introduction to Correctness Aims: To look at the different types of errors that programs can contain; To look at how we might detect each of these errors; To look at the difficulty of detecting

More information

Outline. General properties of type systems. Types in programming languages. Notation for type rules. Common type rules. Logical rules of inference

Outline. General properties of type systems. Types in programming languages. Notation for type rules. Common type rules. Logical rules of inference Type Checking Outline General properties of type systems Types in programming languages Notation for type rules Logical rules of inference Common type rules 2 Static Checking Refers to the compile-time

More information

Programming Languages Third Edition

Programming Languages Third Edition Programming Languages Third Edition Chapter 12 Formal Semantics Objectives Become familiar with a sample small language for the purpose of semantic specification Understand operational semantics Understand

More information

Formal Methods in Software Development

Formal Methods in Software Development Formal Methods in Software Development Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at

More information

L7.2.2 Deliverable - Final report on experimentations on industrial case studies

L7.2.2 Deliverable - Final report on experimentations on industrial case studies L7.2.2 Deliverable - Final report on experimentations on industrial case studies Release 1.0 Hi-Lite partners May 27, 2013 CONTENTS 1 Introduction 1 2 Analysis of space software 3 2.1 Recalls on the objectives

More information

No model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine

No model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine No model may be available Programmer Software Abstractions Tests Coverage Code Abhik Roychoudhury CS 5219 National University of Singapore Testing Debug Today s lecture Abstract model (Boolean pgm.) Desirable

More information

Combining Static and Dynamic Contract Checking for Curry

Combining Static and Dynamic Contract Checking for Curry Michael Hanus (CAU Kiel) Combining Static and Dynamic Contract Checking for Curry LOPSTR 2017 1 Combining Static and Dynamic Contract Checking for Curry Michael Hanus University of Kiel Programming Languages

More information